Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Scott Kitterman <[e-mail]>]

On Tuesday, January 14, 2020 9:44:08 AM EST Hector Santos wrote:
> Whether SHA1 usage is 10%, 5% or 1%, we need to remember, it is still
> part of the protocol and DKIM Verifiers MUST be including SHA1 for
> verification purposes.

No.  It's not.  Please review RFC 8301, which updates RFC 6376:

> 3.1.  Signing and Verification Algorithms
> 
>    DKIM supports multiple digital signature algorithms.  Two algorithms
>    are defined by this specification at this time: rsa-sha1 and
>    rsa-sha256.  Signers MUST sign using rsa-sha256.  Verifiers MUST be
>    able to verify using rsa-sha256.  rsa-sha1 MUST NOT be used for
>    signing or verifying.
>    
>    DKIM signatures identified as having been signed with historic
>    algorithms (currently, rsa-sha1) have permanently failed evaluation
>    as discussed in Section 3.9 of [RFC6376].

I know you know this, so please stop pretending it's not true.

Scott K