> -----Original Message----- > From: ietf-dkim-boun...@mipassoc.org [mailto:ietf-dkim-boun...@mipassoc.org] > On Behalf Of Julian Mehnle > Sent: Tuesday, October 05, 2010 7:27 AM > To: ietf-dkim@mipassoc.org > Subject: Re: [ietf-dkim] ISSUE: 4871bis - Security Loop hole with Multiple > 5322.From > > No. The trick is to list From twice in h=. This ensures more From > headers cannot be added without breaking the signature.
But the attacker in this scenario is already the signer (or has compromised the signer), so he/she will just sign the single From:. > Perhaps this could be mentioned in the spec with a specific reference > to the From header, but in general terms the spec is pretty clear about > how to prevent the addition of a header field. From: is already there. The RFC explains how to prevent addition of a field that wasn't there to begin with, not to prevent addition of new ones. Enumerating MUA issues, though, is a bottomless pit and not really within our scope to do. We should avoid it. _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
