Re: replay, revocation, repudiation, was RE: [ietf-dkim] On per-user-ke

Hi Tony,
At 10:50 11-08-2005, Tony Finch wrote:
> I'm not sure why Phillip thinks DKIM requires a full-on PKI. Isn't
> publishing and removing short-lived keys in the DNS sufficient? Key
> removal provides a simple repudiation mechanism, if the TTLs are suitably
> short.

Key removal may also affect valid mail that has been sent during that 
time.  Key removal may not be an adequate repudiation mechanism, 
especially for large domains.  If the TTL is too short, we lose the 
benefits of DNS caching.

Regards,
-sm