Hi Taavi, hi all, It looks like Taavi Eomäe aimed to say: > Hi, > > On 04.09.2026 15:30, Timo Gerke wrote: >> Because a signature lifetime (x=) and a cryptographic key >> validity period serve two fundamentally different operational >> purposes > > If they already serve two fundamentally different operational purposes > it would make sense that they're handled by two different layers.
Taavi, yes they serve completely different purposes, but an expired key can not create a valid signature. Crucially, key revocation at the DNS layer deterministically invalidates any signature bound to that selector. This architectural dependency is exactly why the wire transport metadata layer must remain clean and strictly flat (d=1), ensuring that boundary ASICs can process the packet at line-rate without handling policy-driven parsing loops. [snip] Timo -- Timo Gerke Hamburg, Germany "If you think technology can solve your security problems then you don't understand the problems and you don't understand the technology." -- Bruce Schneier
OpenPGP_0x9F03DF9F597BF31E.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
