> Do you have some heuristics for picking the best key, and if so, could > an adversary game those heuristics to get the sender to pick a key > published by the adversary?
I'd assume the timestamp would be used to break ties. And they discount the attacker that makes a false key because "they wouldn't be able to receive the emails anyway". I hope users are encouraged to use the long fingerprint when verifying keys as creating a false key with a selected short fingerprint is trivial (see my ABCDABCD).
_______________________________________________ Messaging mailing list [email protected] https://moderncrypto.org/mailman/listinfo/messaging
