3 ms·
Using ECC would solve this particular problem, because in both DKIM and DNSSEC usage of key lengths of 512 to 768 bits and not more are motivated by what can fi
by dfox 14y ago
Using ECC would solve this particular problem, because in both DKIM and DNSSEC usage of key lengths of 512 to 768 bits and not more are motivated by what can fit into one UDP DNS reply packet. Also for RSA signature size is equal to key length, and not some small multiple of security parameter and you don't want to expand messages by including large signature that might well be larger than actual payload.
- mikeash 14y agoRight. Either expanding the key length or using ECC would fix it. So saying the problem isn't one of those, but is only the other, doesn't make much sense to me. ECC may even be a better solution, as you say, but that doesn't mean that the problem isn't also one of an insufficiently long key.