Re: [Dcrup] rsa-sha1 usage

[Scott Kitterman <[e-mail]>]

On June 13, 2017 10:41:42 AM EDT, Jim Fenton <[e-mail]> wrote:
>On 6/13/17 5:05 AM, Salz, Rich wrote:
>>
>> As a newcomer to DKIM (I come from the crypto side of things) I am a
>> bit confused.
>>
>>  
>>
>> Certificates last for a couple of years, and so there was a strong
>> motivation to move off MD5 and then SHA1, because of the concern that
>> someone would find a collision and create a bogus certificate during
>> the original cert’s lifetime.
>>
>>  
>>
>> But I’ve heard that DKIM “trust lifetime” is much shorter.  Is it? 
>> What is the expected lifetime for relying on a DKIM signature?
>>
>
>The expected lifetime is on the order of a week (message delivery
>timeout). But the signature doesn't have an expiration time, so if
>someone can construct a second message with the same hash, they could
>replay the signature, potentially much later if the public key is still
>in DNS.
>
>IMO it seems very unlikely, even with the known weaknesses in SHA-1,
>that in the near future someone would be able to construct such a
>message that would be exploitable by an attacker (e.g., spam or a
>phishing attack). That will likely change in the future, so we should
>tell signers to stop using SHA-1 ASAP and tell verifiers to stop
>accepting those signatures sometime later.
>
>If anyone knows something yet more serious about exploitability of
>rsa-sha1, please set me straight.
>
>-Jim

I'm not an expert at all, but at least to the degree I understand it, I think your understanding of the rsa-sha1 situation is correct.

I think your proposed remedy is too mild though.  Given the degree to which the SHOULD NOT sign rsa-sha1 has been ignored for the last decade, I don't believe anything other than MUST NOT sign/MUST NOT verify rsa-sha1 is very useful.

The thing about weaknesses​ in cryptographic algorithms is that the timeline for their discovery isn't predictable.  I believe that most cryptographic experts anticipate that such weaknesses exist and will be found, we just don't know when.

Given that we have rsa-sha256 available, I think it would be irresponsible not to remove rsa-sha1 from the DKIM protocol.  Operational practice​ isn't closely coupled with standards changes.  Killing off rsa-sha1 now is the best thing we can do to minimize​the panic when a problem does become known.

To the extent standards changes matter, engineering resources don't get assigned beyond the minimum needed.  I imagine a manager dropping our RFC on the (metaphorical) desk of one​ of their engineers and asking what's the minimum change required by the RFC.  If the answer leaves rsa-sha1 in use, I think it's a mistake.

Scott K