Re: [Dcrup] new version draft-ietf-dcrup-dkim-crypto-04

["John R Levine" <[e-mail]>]

> This looks pretty good.

Thanks,

> The abstract still says "and deprecates an obsolete signing
> algorithm",

Right, it's gone.

> In the spirit of leaving the removal of the crusty old stuff to the
> other draft, I think that you should:
>
> 1. remove the clause from the abstract
> 2. remove the first paragraph of Section 6 (which specifies the update
> to RFC 6376)
> 3. remove the requirement to use 1024-bit keys for "rsa-sha256"

That makes no sense to me.  Going forward, if DKIM signers and verifiers 
are going to interoperate, the verifiers have to handle every signature 
that a signer can create.  It's not like TLS where they get to negotiate 
at connection time.  So we have to update 6376 to add all the new 
signature methods that a signer might use.  Also remember that the current 
unhashed RSA works just fine for the large fraction of signers whose DNS 
provisioning system isn't broken, so we're not deprecating it.

For the editorial stuff, you're right that I confused p= and k= which I 
think are right in the -05 version.  The text changes don't seem any 
clearer to me so I'll wait and see what other people say.

> Final unrelated comment:
>
> You recommend that "rsafp signatures SHOULD use key lengths of 1536 or
> 2048 bits".

Well, actually, I said 1536 to 2048 bits in one place and 1024 to 2048 in 
another.  Oops.  I took out the second and now says signatures MUST be at 
least 1024 bits and SHOULD be 2048 bits, and verifiers MUST NOT accept 
shorter than 1024.  I think that matches reality, particularly the final 
MUST NOT to get the remaining 512 bit signers to increase the key size.

R's,
John