At 1:42 PM -0400 8/7/08, Turner, Sean P. wrote:
>Proposed wording:
Receiving agents that validate signatures need to be cautious
of CPU usage when validating signatures larger than those
mandated in this specification. An attacker can send very
large, bogus signatures in order to swamp the CPU of the
receiving party. Receiving parties that verify large
signatures are advised to have some sort of resource
management system to prevent such an attack.
Is this in addition to or to replace the para that starts "Larger keys are
not" in 3851bis Sec 5?
Replace.