Re: [Dcrup] rsa-sha1 proposals

[Hector Santos <[e-mail]>]

On 6/20/2017 3:00 PM, Kurt Andersen wrote:
>
> I'm in favor of moving strongly and clearly to kill sha1, but what
> about moving it out to the registry with a dated "MUST NOT". That
> provides for a deprecation period without the need for further
> intervention. The other advantage is that it provides a stronger
> historical record that people can point to when explaining
> brain-deadness to people who have not updated :-)
> I would suggest a "drop dead" date of something like mid-2018 to allow
> the rest of this work to reach completion.
>

-1.

I'm not going to stop supporting SHA1 and invaliding signatures based 
on a drop dead date. I would prefer a "hint" from the already existing 
overhead DNS lookups being down, i.e. either the key lookup or author 
domain policy.   If the "Author Domain" says "we only do SHA256, then 
that should allow for a supportive verifier to act accordingly.

-- 
HLS