Key Disclosures

I've had a thought regarding key disclosures, provoked by the question of how many 
keys should be contained in the key disclosure list.  If one thinks about the answer 
to this question, it seems like a reasonable objective is to ensure that the 
receiver of an itrace packet has a reasonable probability (e.g. 80%) of receiving a 
successor packet that disclosues the key applicable to the first packet.  Now 
suppose we create a reasonable reference model of packet flow, work out what is 
required to achieve the objective, and determine that it is impractical?  Maybe we 
should step back a moment.

Does the hash key disclosure actually have to be part of the packet?  Could the 
packet instead point to a location where the hash keys can be found, along with 
suitable certification et cetera?  That way a receiving host only needs to get one 
packet from the generating host rather than two to perform its analysis.  An 
attacker can't really provoke a DOS on the key repository if we go this way, since 
queries would come in on a per-analysis batch basis rather than per-packet.

Tom Taylor