It appears that Richard Clayton <[email protected]> said: >>I would get rid of the hash-any option and keep hash-all, so the verifier has >>to >>check every hash it understands and pass if all the ones it checked are good. > >if we introduce a new hash I'd expect to see signing with > > sha256 OR newhash > >because a Verifier would not necessarily understand newhash. If we only >keep hash-all such a Verifier would fail the message (the result for >something you do not understand is a fail).
Perhaps we're in the weeds here but as I said, I'd only keep AND with the meaning that you verify all the ones you understand and if the ones you verify are good, you succeed. If you only understand sha256 and it's good, pass. The only sensible scenario for multiple hashes other than testing is to add a new algorithm. No matter what you call it, the rule has to be that the ones you understand are good. R's, John _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
