Subject: RE: [ietf-dkim] mailing lists and -base

From: <[email-masked]>
Date: Tue, 28 Mar 2006 11:46:43 -0500

Is signing the body at all an essential requirement? Yes, some potential
risk for a replay attack but otherwise "whoami I sent this" should be
sufficient for some providers,

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Arvel Hathcock
Sent: Tuesday, March 28, 2006 11:22 AM
To: [email-masked]
Subject: Re: [ietf-dkim] mailing lists and -base

 > The current proposal for allowing signers to only have to compute the
 > hash once for large message bodies that will be sent out numerous
 > times (such as in a mailing list) seems like an improvement.

I can not disagree.  It isn't always the case, but it is often the case,

and likely always at least optional that mailing lists personalize the 
TO header.  When this is done, a single body hash which could be reused 
is an improvement.

-- 
Arvel

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jim Fenton <[email-masked]>
Date: Tue, 28 Mar 2006 09:01:32 -0800

> sufficient for some providers,
As long as people support the l= tag, they could use l=0 to not sign the
body.  This capability has been cited as a reason to get rid of l=
because it facilitates such "dangerous" behavior.  IMO, if they want to
sign such messages, and recipients want to accept them, let them do that.

-Jim