Hi Taavi, hi all, The proof lies within the structural constraints of the chosen format.
By introducing nested JSON objects, the DKIM2 specification inherently imports the undefined behaviors defined in RFC 8259, Section 4 (regarding duplicate keys). When a core protocol specification relies on a syntax where object behavior is explicitly declared as "undefined", it creates an architectural vulnerability. This is a design flaw because "reasonable implementations" cannot resolve ambiguities that are permitted by the underlying specification itself. A flattened object-array layout or a deterministic tag-value mechanism enforces strict linear O(n) parsing constraints directly on the protocol layer. This completely eliminates algorithmic complexity DoS and parsing differentials by design. Best, Timo It looks like Taavi Eomäe aimed to say: > Hi, > > On 22.09.2026 11:25, Timo Gerke wrote: >> [...] this is a design flaw. > Reading this thread I don't see how that statement has been conclusively > proven so that it doesn't apply to other approaches, including > reasonable implementations. > > > Best, > Taavi Timo Gerke Hamburg, Germany "If you think technology can solve your security problems then you don't understand the problems and you don't understand the technology." -- Bruce Schneier
OpenPGP_0x9F03DF9F597BF31E.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
