Re: [Dcrup] I-D draft-ietf-dcrup-dkim-crypto-06

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>I already did.  All assumed immediately the re-hash, once it was
>accepted that we had no chance of the libraries providing a pure
>signing facility.  I didn't see one that suggested that the headers
>be passed in original unhashed form to the library hash-and-sign.

As several people noted, passing the unhashed canonicalized headers
and body would require opening up code that was written and debugged a
decade ago, and inventing some tricky coroutine interfaces since the
string is likely to be too big to buffer in memory.

Compared to that, a second hash is a no-brainer.

R's,
John