[Dcrup] draft-ietf-dcrup-dkim-crypto-00

["Mark D. Baushke" <[e-mail]>]

Hi,

I suggest that 2048 bit RSA be considered the minimum key size.
Samller sizes are not really safe these days.

In any update of RSA, you really need to determine if your RSA keys will
be using RSASSA-PSS or PKCS#1 v1.5 padding and be careful in the
signature verification methods being used as well as specifying the use
of the SHA2 hash to be used if the key size is greater than RSA 3072
which is the largest that should probably use SHA2-256. RSA key sizes in
excess of 3072-bit keys may want to consider SHA2-384 or SHA2-512
hashes.

I note that you are suggesting signing using ECDH and wonder if you
intended to specify ECDSA or EdDSA as a way to digitally sign using
Elliptic Curve methods as generally ECDH is used for key agreement
protocols.

In section 5, you ask

[[ is there any reason to allow or require RSA keys longer than 2048 ? ]] 

I do not believe that this is required today. However, it will probably
be true in a short number of years.

The IETF CURDLE (CURves, Deprecating and a Little more Encryption) WG
has a few drafts you may wish to read such as

  draft-ietf-curdle-cms-eddsa-signatures

For this draft and others, you may visit:

  https://datatracker.ietf.org/wg/curdle/documents/

An informative reference for your consideration:

The National Institute of Standards and Technology (NIST) Special
Publication 800-131A [800-131A] disallows the use of RSA and DSA keys
shorter than 2048 bits for US government use after 2013.

  http://dx.doi.org/10.6028/NIST.SP.800-131Ar1

Another informative reference:

  Fault-Based Attack of RSA Authentication
  Andrea Pellegrini, Valeria Bertacco and Todd Austin
  http://web.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf

I hope you find the above information useful.

	Enjoy!
	-- Mark