Re: possible bug in Mail::DKIM when keysize is under 1024 bits

2015-01-12 Thread Franck Martin
On Jan 12, 2015, at 4:58 PM, Mark Martinec wrote: >> On January 12, 2015 8:06:00 AM EST, Mark Martinec >>> It would be wrong to assign score to short keys. > > Kevin A. McGrail wrote: >> Actually the rfc specifies that keys 512 to 2048 bits must be verified >> so I think there is a grey area an

Re: possible bug in Mail::DKIM when keysize is under 1024 bits

2015-01-12 Thread Mark Martinec
On January 12, 2015 8:06:00 AM EST, Mark Martinec It would be wrong to assign score to short keys. Kevin A. McGrail wrote: Actually the rfc specifies that keys 512 to 2048 bits must be verified so I think there is a grey area and there is this long-lived key caveat as well. I think if we ca

Re: Milter (was Re: starttls verify=OK not recognized by rule)

2015-01-12 Thread Kevin A. McGrail
On 1/12/2015 10:06 AM, MAYER Hans wrote: Dear David, Thanks for your information. I expected something like this. If you want to check for TLS verification, you need to do it outside SpamAssassin and pass the Sendmail macro ${verify} down into MIMEDefang. All in all, a bit of a mess. I agree

RE: Milter (was Re: starttls verify=OK not recognized by rule)

2015-01-12 Thread MAYER Hans
Dear David, Thanks for your information. I expected something like this. > If you want to check for TLS verification, you need to do it outside > SpamAssassin and pass the Sendmail macro ${verify} down into MIMEDefang. > All in all, a bit of a mess. I agree. And then it has to be passed to

Re: Permission Problem and bad file descriptor

2015-01-12 Thread Kevin A. McGrail
Looks like you have a cron job for sa-update running. What user is running that cron job and what are the perms on the directory? For the user pref dir, no it is not created manually. It is going to be a combination of parameters for your spamc and spamd, what user the progs run as and the pe

Re: possible bug in Mail::DKIM when keysize is under 1024 bits

2015-01-12 Thread Kevin A. McGrail
Actually the rfc specifies that keys 512 to 2048 bits must be verified so I think there is a grey area and there is this long-lived key caveat as well. I think if we can make a rule that fires on <1024 bits it's would be good. The score may not be much but it could be helpful. Regards, KAM On

Re: possible bug in Mail::DKIM when keysize is under 1024 bits

2015-01-12 Thread Mark Martinec
On Jan 11, 2015, at 3:40 PM, Kevin A. McGrail wrote: I disagree as well. You can't cherry pick your quotes and you are missing the long-lived caveat as well as the next sentence: Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits If it is 512 to 2048, I