-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Hannah Stern
<[email protected]> writes
>> sha512 is now required as a hash function alongside sha256. This is
>> mainly to allow implementors to test their code for multiple hash
>> functions; we might want to take it out before finalising the
>> document but for the moment it is a MUST for Verifiers
>
>I observe that for the "top-level" hash/signature, we still only have
>rsa-sha256 and ed25519-sha256. Cryptographically, I'm not sure how much
>sense it makes to have sha512 in Message-Instance, but then hashing them
>(textually via the Message-Instance fields) with sha256 at signing time.
sha256 is just fine from a cryptographic point of view (he says as a
someone who tries to keep up with consensus rather than a real expert)
the point of adding sha512 was to ensure that people actually read the
string rather than just assuming it said sha256
note that different things are hashed for M-I and for D-S (ie its not
that there is part-calculation hanging around that you could use to
speed things up)
>> there is now text to forbid repetition of algorithm or selectors
>> (there's no interop issues here, but it means you can reject
>> messages that are just trying to push up your electricity bill)
>
>I read some inconsistency there:
>
>- For M-I the language is clear, only at most one hash of a given type
yes
>- For D2-S, the language is less clear. I interpreted the previous draft
>to forbid duplicate selectors already, but not duplicate algorithms. Now
>the language says that duplicate algorithms are actually allowed, but at
>most 2 signatures per algorithms.
yes you understand the language correctly ... it occurred to me as I was
writing this bit that people might want to sign with two keys because
they were transitioning from one to another. However, if you removed one
of the keys from the DNS then a Verifier has one signature that worked
and one signature that gave an error.
So today I think this was probably a mistake and unless anyone loves it
(and can tell us how to combine the two results) then I will insist on
just one signature per algorithm (which mean unique selectors because
keys say which algorithm they are for)
>- But later in the error messages, there's the error string
>"DKIM2-Signature i=<x> has too many signatures" suggesting a limit (from
>the standard, not operationally imposed) on _total_ number of signatures
>per DKIM2-Signature field?
the idea was you would issue this if the two was exceeded
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBao93AWHfC/FfW545EQLKVACgl646DP3G1NDxsgOMWcJqG2YvdpwAn1Jk
1g12JMJxCDAGFdrkRSxNOyNy
=UyRs
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
