-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Timo
Gerke <[email protected]> writes
>Taavi, yes they serve completely different purposes, but an
>expired key can not create a valid signature.
of course it can -- you may not trust it but that's not the same
statement at all
>Crucially, key revocation at the DNS layer
>deterministically invalidates any signature bound to that
>selector.
you will find discussion of key revocation in the DKIM1 RFC and also in
Wei's draft --- but most people do not revoke DKIM keys, they merely
remove them from the DNS
>This architectural dependency is exactly why the wire transport
>metadata layer must remain clean and strictly flat (d=1),
>ensuring that boundary ASICs can process the packet at line-rate
>without handling policy-driven parsing loops.
SMTP systems (have a look around as to where you are) do not process
"packets" and they do not rely on ASICs to do anything.
You should probably also read up on STARTTLS because almost every
"boundary" device which sees tcp/25 traffic will be unable to peer
through the encryption to see anything, metadata (whatever that may be
in this context) or otherwise
please stop digging
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBap7ypGHfC/FfW545EQJhIQCgkyyUXSH+056Up5uK7KXVyTmzZQoAoP6S
08f8CPFFIMhVcWmr6q3MY+Gn
=tImV
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
