On July 17, 2005 at 00:27, domainkeys-feedbackbase02(_at_)yahoo(_dot_)com wrote:
X I = I + 1;
is a comment, where as:
X I = I + 1;
is not.
So, if you have a canonicalization algorithm that ignores spaces, you could
reinject an email that has the X in the comment column with an email that has
the X in a non-comment column, thus completely changing the semantics of the
content, yet the signature still verifies.
A good example that the nowsp algorithm in the DKIM draft is not
acceptable. Basically, when whitespace is significant, it should
not be eliminated. That is why only trailing whitespace at the end
of lines should be done (along with removing LWSP at end of entities).
--ewh