Subject: [saag] Don't use short keys...

From: Steven Bellovin <[email-masked]>
Date: Wed, 24 Oct 2012 09:53:14 -0400

http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

---

From: SM <[email-masked]>
Date: Wed, 24 Oct 2012 17:01:10 -0700

>http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/

Dan Romascanu filed the following comment about a draft in January:

  '2. I know too little about the operational model of configuring a report
      generator, so I was left wondering how are the first two
      recommendations implemented in practice:

      1.  Select an arbitrary string that will be used by an Administrative
          Management Domain (ADMD) that generates reports.  This string
          will not be changed except according to a key rotation policy or
          similar.  Call this the "redaction key".'

It is unfortunate that security considerations in specifications are 
not given adequate consideration.  Software is installed in fire and 
forget mode [1].  Implementing recommendations such as the above, for 
example, might help remove some of the cruft.

Regards,
-sm

1. I don't claim to be any better.