Subject: RE: [ietf-dkim] The key record upgrade attack

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 4 Aug 2006 11:41:10 -0700

> [mailto:[email-masked]] On Behalf Of Paul Hoffman

> That's not what Doug said. He said:
> >  > >During a transition, it would be important to communicate
> >>  what will be
> >>  >offered and what has been deprecated.  Then these 
> options MUST be  
> >> >available or the related signatures MUST be ignored.
> 
> I specifically object to the last three words.

OK, that is fine. 

What I was trying to say is that it is possible to meet the security requirement that Doug raised without coming into conflict with base.

The security requirement here is not a MUST. 

The only reason to look at a policy record is:

1) There is no security record there at all
2) You do not find one that you like

It is only in the second case that you would find a good signature and go look for a policy record anyway.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html