spf-discuss
[Top] [All Lists]

RE: Attacking Domain Keys

2004-11-30 10:46:20
Seth's not a troll.  It is very amusing though how anything a large 
corporation does gets almost universal scorn around here.  Especially 
amusing in the case of Yahoo!, since they actively contribute 
back to a number of open source communities.

Yahoo is not the only company who went out to look at a signature scheme. In
addition to the scheme published by CISCO, VeriSign also designed a scheme
and Microsoft proposed a scheme in the larger strategy that Caller-ID came
from.

If you look at the four schemes they are all identical give or take minor
differences of syntax.

If you want to do cryptographic authentication you have a fairly limited set
of options. From a practical point of view you have to go with public key
since there is a one to one mapping to the problem public key signatures
solve. Any scheme that allows a party to send a self authenticating message
on the basis of static validation key data will be definition be a public
key signature scheme. RSA is the only public key signature algorithm that is
acceptably secure, unencumbered and supported by a wide range of accelerator
hardware.

It does not do any good for SPF for Seth to go round competition yapping and
trying to bite their hubcaps. SPF is a useful scheme, DK is a useful scheme,
they both have advantages and disadvantages.


<Prev in Thread] Current Thread [Next in Thread>