To: dcrup@ietf.org
References: <m38tkw53bd.fsf@carbon.jhcloos.org>
 <CABa8R6s6rzc+Ky8sLWcK7NtforSksEhNRkWVeF=k1v8GC80knw@mail.gmail.com>
 <m3wp8gpx20.fsf@carbon.jhcloos.org>
 <CAOj=BA2O+Hf2VGOtbmnqY2M5J9u8uJ7wm7SxEW551SXBwDdanw@mail.gmail.com>
 <5bf52517591d4950aec335d31bcf3631@usma1ex-dag1mb1.msg.corp.akamai.com>
 <aa52134a-ac20-bd70-8834-1598a8eaa536@bluepopcorn.net>
 <29B74569-6BB3-43F8-9549-566DA405B1FF@kitterman.com>
 <CAL0qLwaqPwb+cNhRCWLBp2qjTWtS65JAvstc9GfrhDDXRv+d6w@mail.gmail.com>
 <57fda1d5-b0b7-f226-60db-7f4c47233fc7@bluepopcorn.net>
 <CAL0qLwbFE5PzpOWzn-DwQ2D0z0=OAtEJLnwBbq2hk2SK2pc4Bg@mail.gmail.com>
From: Jim Fenton <fenton@bluepopcorn.net>
Message-ID: <87dfdc8c-5acc-e51e-a6d3-1e35611419b7@bluepopcorn.net>
Date: Tue, 13 Jun 2017 20:20:42 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <CAL0qLwbFE5PzpOWzn-DwQ2D0z0=OAtEJLnwBbq2hk2SK2pc4Bg@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------E9F0D02D1619807CED60CBBC"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/89GsdgKyC1YvoFjAdKYMU6TrF4o>
Subject: Re: [Dcrup] rsa-sha1 usage
Precedence: list

This is a multi-part message in MIME format.
--------------E9F0D02D1619807CED60CBBC
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

On 6/13/17 8:16 PM, Murray S. Kucherawy wrote:
> On Tue, Jun 13, 2017 at 6:55 PM, Jim Fenton <fenton@bluepopcorn.net
> <mailto:fenton@bluepopcorn.net>> wrote:
>
>>     That being the case, why do we think people will pay attention to
>>     a MUST NOT today?
>
>     Because implementations will stop supporting rsa-sha1, forcing the
>     issue for any who upgrade. I'm all for having them stop supporting
>     signing with rsa-sha1, but they should continue to support
>     verification for a while.
>
>
> We can't have this logic both ways.  Scott claimed nobody pays
> attention to the advice in RFCs ("Operational practice​ isn't closely
> coupled with standards changes").  If that's true, then there's no
> meat to a MUST NOT anyway, and it really only matters what people will
> implement.  And if that's true, then saying current implementations
> neither sign with nor verify "rsa-sha1" because it's deprecated
> suffices, and we're done.

Based on no supporting data whatsoever, my conjecture is that
implementers pay a lot more attention to what RFCs say than people who
are deploying others' implementations. Which basically boils down to
MUSTs having a significant effect and SHOULDs having little. Which is
why I favor making signing with rsa-sha1 a MUST NOT prior to making
verification of rsa-sha1 signatures a MUST NOT.

-Jim

--------------E9F0D02D1619807CED60CBBC
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">On 6/13/17 8:16 PM, Murray S. Kucherawy
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAL0qLwbFE5PzpOWzn-DwQ2D0z0=OAtEJLnwBbq2hk2SK2pc4Bg@mail.gmail.com">
      <div dir="ltr">On Tue, Jun 13, 2017 at 6:55 PM, Jim Fenton <span
          dir="ltr">&lt;<a href="mailto:fenton@bluepopcorn.net"
            target="_blank" moz-do-not-send="true">fenton@bluepopcorn.net</a>&gt;</span>
        wrote:<span class="gmail-"></span><span class="gmail-"></span><br
          class="gmail-m_7941309515915358628Apple-interchange-newline">
        <span class="gmail-"> </span>
        <div class="gmail_extra">
          <div class="gmail_quote">
            <blockquote class="gmail_quote" style="margin:0px 0px 0px
              0.8ex;border-left:1px solid
              rgb(204,204,204);padding-left:1ex">
              <div bgcolor="#FFFFFF"><span class="gmail-">
                  <blockquote type="cite">
                    <div dir="ltr">
                      <div class="gmail_extra">
                        <div class="gmail_quote">
                          <div>That being the case, why do we think
                            people will pay attention to a MUST NOT
                            today?<br>
                          </div>
                        </div>
                      </div>
                    </div>
                  </blockquote>
                  <br>
                </span> Because implementations will stop supporting
                rsa-sha1, forcing the issue for any who upgrade. I'm all
                for having them stop supporting signing with rsa-sha1,
                but they should continue to support verification for a
                while.</div>
            </blockquote>
            <div><br>
            </div>
            <div>We can't have this logic both ways.  Scott claimed
              nobody pays attention to the advice in RFCs ("Operational
              practice​ isn't closely coupled with standards changes"). 
              If that's true, then there's no meat to a MUST NOT anyway,
              and it really only matters what people will implement. 
              And if that's true, then saying current implementations
              neither sign with nor verify "rsa-sha1" because it's
              deprecated suffices, and we're done.</div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    Based on no supporting data whatsoever, my conjecture is that
    implementers pay a lot more attention to what RFCs say than people
    who are deploying others' implementations. Which basically boils
    down to MUSTs having a significant effect and SHOULDs having little.
    Which is why I favor making signing with rsa-sha1 a MUST NOT prior
    to making verification of rsa-sha1 signatures a MUST NOT.<br>
    <br>
    -Jim<br>
  </body>
</html>

--------------E9F0D02D1619807CED60CBBC--