Re: [Dcrup] rsa-sha1 proposals

[Kurt Andersen <[e-mail]>]

On Tue, Jun 20, 2017 at 8:39 AM, Scott Kitterman <[e-mail]>
wrote:

>
> I think there are roughly three options that have been discussed:
>
> Status quo:
>
> > Signers MUST implement and SHOULD sign using rsa-sha256.  Verifiers MUST
> > implement both rsa-sha1 and rsa-sha256.
>
> Deprecate rsa-sha1:
>
> > Signers MUST implement and sign using rsa-sha256 only.  Verifiers MUST
> > implement both rsa-sha1 and rsa-sha256.
>
> Remove rsa-sha1:
>
> > Signers MUST implement and sign using rsa-sha256 only.  Verifiers MUST
> > implement rsa-sha256.  rsa-sha1 is obsolete and MUST not be used.
> Note: This option also removes rsa-sha1 from the ABNF.
>

[elided]

Remove rsa-sha1:
> This option eliminates (to the extent it is adopted) the potential of
> security
> risks with rsa-sha1.  .  .
> While this might be considered somewhat abrupt, rsa-sha1 signing has been
> effectively SHOULD NOT for a decade.  Maybe this will create some momentum
> for
> operators to move off of it.
>
> It is abrupt to remove something without a formal deprecation period.
>

I'm in favor of moving strongly and clearly to kill sha1, but what about
moving it out to the registry with a dated "MUST NOT". That provides for a
deprecation period without the need for further intervention. The other
advantage is that it provides a stronger historical record that people can
point to when explaining brain-deadness to people who have not updated :-)
I would suggest a "drop dead" date of something like mid-2018 to allow the
rest of this work to reach completion.

--Kurt