Re: [Dcrup] rsa-sha1 proposals

On Tue, Jun 20, 2017 at 8:39 AM, Scott Kitterman <sklist@kitterman.com>
wrote:

> Remove rsa-sha1:
> This option eliminates (to the extent it is adopted) the potential of
> security
> risks with rsa-sha1.  If a relevant issue with rsa-sha1 is made public,
> there
> will be no further standards work that needs to be done.  This option also
> keeps the number of algorithms at two, eliminating the additional
> complexity
> associated with having more algorithms to sort through in implementation.
> While this might be considered somewhat abrupt, rsa-sha1 signing has been
> effectively SHOULD NOT for a decade.  Maybe this will create some momentum
> for
> operators to move off of it.
>
> It is abrupt to remove something without a formal deprecation period.
>

I strongly vote to remove SHA1 as proposed here; I do not believe any other
approach will incentivize senders or receivers to make the change.

I do not believe this qualifies as an "abrupt" deprecation, as you said, it
has been SHOULD NOT for over a decade.

> Thoughts?
>
> Scott K
>
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup
>