Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Hector Santos <[e-mail]>]

On 1/7/2020 6:41 PM, Scott Kitterman wrote:
> https://sha-mbles.github.io/
>
> If I'm reading this right, the last excuse that still trusting SHA-1 DKIM
> signatures is an OK thing to do is gone.  Comments from anyone that really
> understands thus stuff would be appreciated.

-1 to the subject question.

Comments from implementators who only need to peripherally 
"understand" it, should be commenting.  Did we want a discussion on 
theory?

Despite the paper's claim for a clobbering technique, this is a 
time-shifted application problem -- replays after a secured message 
has been received and maybe not read yet.  If read, expiration 
concepts should apply.  In fact, we should probably be recommending x= 
expiration times.  Right now, the default is off.

    x= Signature Expiration (plain-text unsigned decimal integer;
       RECOMMENDED, default is no expiration).  The format is the same as
       in the "t=" tag, represented as an absolute date, not as a time
       delta from the signing timestamp.  The value is expressed as an
       unsigned integer in decimal ASCII, with the same constraints on
       the value in the "t=" tag.  Signatures MAY be considered invalid
       if the verification time at the Verifier is past the expiration
       date.  The verification time should be the time that the message
       was first received at the administrative domain of the Verifier if
       that time is reliably available; otherwise, the current time
       should be used.  The value of the "x=" tag MUST be greater than
       the value of the "t=" tag if both are present.


But we have a higher potential, replay damage coming from allowing 
5322.From Rewrites to have evolve among some packages.  SHA1 usage is 
the least of my DKIM concerns.

Nonetheless, we are already promoting verify only, not signing.  Is 
that not enough? Or are we now promoting the suggestion to remove SHA1 
from APIs and tools?   I read a statement the OpenSSL folks were 
thinking about removing it. That would be a horrible decision and it 
just someone's belief, not the OpenSSL team because then we really 
create REAL damage by forcing SHA1 signatures fails which are 
otherwise secured right now.

Lets fix the real Rewrite potential problems first before worrying 
about SHA1.

-- 
HLS