Re: [Dcrup] sequence of drafts, draft-ietf-dcrup-dkim-usage and document shepherds

["Murray S. Kucherawy" <[e-mail]>]

I'll reply about the document sequence separately, but on this point:

On Sat, Jun 10, 2017 at 1:29 PM, Scott Kitterman <[e-mail]>
wrote:

> Personally, I prefer the explicit MUST NOT we had in -01 and I think that's
> along the lines of what Martin Thomson was suggesting.  A hatless msk
> preferred something more like what's there now.
>
> Technically, I think the amount to the same thing.  Is it better to be more
> explicit about what's being removed or be implicit by removing it from
> what's
> specified?  Personally, I think explicit is better than implicit, but
> being a
> Python guy, I would [1]
>

I think the discussion never fully landed, and it may have gotten mixed in
with the discussion about how to regulate key sizes, if it's even possible
to do that.  Only a few opinions have been expressed, and nobody's
commented up or down on the -02 text yet.

Remaining hatless, I prefer the current approach because, like key sizes,
we're not talking about an interoperability concern but rather a policy
one.  There's nothing broken about DKIM implementations that use rsa-sha1.
It's just a bad idea now although it wasn't yet when RFC4871 came out.
Although many receivers may choose to treat all rsa-sha1 signatures as
failed on principle, that's not (and, I would argue, shouldn't be)
intrinsic in the protocol.

My understanding of the use of RFC2119 language is that it's used to
describe choices that affect interoperability, while small key sizes and
use of SHA1 are choices that clearly reduce security but interoperate just
fine.  Then Martin suggested that there's precedent in other RFCs for using
RFC2119 language to discourage use of obsolete security mechanisms.  If
that's the case and we're fine with it, then I'll go along with consensus.

That aside, simply not describing rsa-sha1 going forward, and including an
IANA action to mark it "deprecated" in the registry, seems right to me.  If
we want to add a paragraph in an appendix paying homage to it and including
advice about why its use is no longer a good idea, that's fine too.

-MSK