[Bimi] Re: No cryptographic connection between VMC and DKIM key

[Wei Chuang <[e-mail]>]

I think the researcher was calling out the weak keys found in the survey
that was done of deployed DKIM keys.  In some cases it was due to a Openssl
vulnerability from 2008, and others due to short key length < 2048.  The
researcher suggests that X.509/PKIX keys have a mandate to meet a certain
security bar and the certificates have a TTL that forces key rotation.  By
tying the DKIM public key to the BIMI VMC, the DKIM public key must meet
the same requirements as the VMC and those keys are governed by the VMC
Requirements in order to be properly issued.
-Wei

On Tue, May 14, 2024 at 9:17 AM Dave Crocker <[e-mail]> wrote:

> On 5/12/2024 9:54 AM, Wei Chuang wrote:
> > I would agree the lack of connection between the VMC and the DKIM
> > public keys is a missed opportunity to strengthen the protocol.
>
> I'm not understanding how it stregthens the protocol.  What threats does
> it counter that are not already covered?  And how? And how likely and
> serious are those threats?
>
> Also, what will the effort be, to support this on an ongoing basis, for
> all users of the protocol?
>
>
> d/
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
> mast:@[e-mail]
>
>