Thomas Roessler wrote:
nowsp, when combined with the length parameter, can enable
attackers to completely replace the e-mail content displayed
by mail user agents, without invalidating the DKIM signature.
[...nice example snipped...]
So far for "nowsp", assuming that you got it right. What is
[XINDX] in the draft ?
This problem should be solved on the level of the
canonicalization mechanism
Yes, MIME boundaries are very critical.
whatever canonicalization method is going to be used by DKIM
ought to protect semantics of full MIME parts, including
multipart delimiter lines and individual bodies' headers.
Not protecting the top level final boundary could make sense,
if mailing lists try to add their own crap^WMIME part. In your
example that could be a length up to "<CRLF>--foobar" instead
of the real "<CRLF>--foobar--<CRLF><epilogue>".
Bye, Frank