>>Reply-to and From are both listed twice This is called "oversigning" and means that a null variant of Reply-To: and From: are signed too, preventing adding additional headers of Reply-To: And From:.
This is particular important for headers that are permitted to be in a email multiple times, as an attacker could add headers into a signed mail without failing signature, if the headers are not "oversigned". With oversigning (twice header listing): Signed: Reply-To: m...@somebody.com In email: Reply-To: m...@somebody.com Reply-To: attac...@suspicious.com Would fail signature. Without oversigning (header only listed once): Signed: Reply-To: m...@somebody.com In email: Reply-To: m...@somebody.com Reply-To: attac...@suspicious.com Would pass signature.
smime.p7s
Description: S/MIME Cryptographic Signature
