4 ms·
If Google did rotate the keys, it's quite likely some enterprising people would log observed keys. With access to a log of keys (that you don't believe has been
by advisedwang 6y ago
If Google did rotate the keys, it's quite likely some enterprising people would log observed keys. With access to a log of keys (that you don't believe has been tampered with) then rotating keys doesn't prevent non-repudation.
An alternative would be for email servers to strip the DKIM headers on inbound emails after recording that the email was validated. The email stored at rest then no longer provides non-repudation. Nothing is stopping you doing this today.
- arkadiyt 6y ago> rotating keys doesn't prevent non-repudation That's why he says Google also needs to publish the private keys.
- deleted 6y ago[deleted]
- kennywinker 6y agoI'm not a fan of offloading that trust onto my email host. Not that I validate dkim headers, but the fact that I have access to them keeps my email host honest.