On 2005-02-02 16:12:59 -0800, Jim Fenton wrote:
That's very interesting; this is the first I have heard of this
vulnerability.
It occurs to me that requiring the signing of the Content-Type header
would address this problem. Do you think so?
That would help, yes.
I would also include the Content-Transfer-Encoding with the signed
material -- even though I don't see an obvious attack based on this
one, it may be better to play this part safe.
Note that RFC1847-style signatures do both of these things.
This one has been reported before but we haven't updated the
published spec yet because we are hoping that we can go in the
direction of a merger between IIM and DomainKeys instead. The
latest IIM implementation on SourceForge
(http://sourceforge.net/projects/identifiedmail/) has this fixed;
what we had to do was incompatibly change the fingerprint
calculation by adding the length of the modulus and exponent.
That's good to hear.
Regards,
--
Thomas Roessler, W3C <tlr(_at_)w3(_dot_)org>