Re: [Dcrup] FW: IETF WG state changed for draft-ietf-dcrup-dkim-usage

["Murray S. Kucherawy" <[e-mail]>]

On Sat, Aug 12, 2017 at 2:58 PM, Salz, Rich <[e-mail]> wrote:

> At the IETF meeting last month there was strong consensus to have MUST NOT
> for both generate and verify using SHA-1.  The discussion on the list had
> one major participant opposed, who removed their objection once they
> understood there were two separate documents.
>
> Therefore, we are entering a one-week WG last call.
>
> (Seth, please start preparing your shepherd writeup :)
>

Getting caught up after a long post-Prague vacation and recovery period.

The content and intent seem fine to me.  However, I was asked this after
the meeting in Prague as to form, in the spirit of "it's not done until you
can no longer remove things" or however that aphorism goes:

This document will be shown as "updates RFC6376".  Is replacing text in
RFC6376 the right way to do this?  Or would that not be better left to an
actual replacement document?  That is, why not just say "MUST NOT
sign/verify with rsa-sha1", change the state of "sha1" to obsolete, change
the minimum key size to 1024, and stop?  In particular, is it necessary to
render "a=rsa-sha1" syntactically invalid by removing it from the ABNFs, or
replace all of a section when only a couple of numbers are being tweaked?

Otherwise this seems ready to go.

-MSK, participating