Re: [Dcrup] rsa-sha1 usage

[Jim Fenton <[e-mail]>]

On 6/13/17 6:40 PM, Murray S. Kucherawy wrote:
> On Tue, Jun 13, 2017 at 8:43 AM, Scott Kitterman <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     I think your proposed remedy is too mild though.  Given the degree
>     to which the SHOULD NOT sign rsa-sha1 has been ignored for the
>     last decade, I don't believe anything other than MUST NOT
>     sign/MUST NOT verify rsa-sha1 is very useful.
>
But it isn't a simple SHOULD NOT, because it's followed by:

INFORMATIVE NOTE: Although rsa-sha256 is strongly encouraged, some
      senders might prefer to use rsa-sha1 when balancing security
      strength against performance, complexity, or other needs.  In
      general, however, rsa-sha256 should always be used whenever
      possible.


Basically this seems to be giving signers an out to use rsa-sha1 because
performance of rsa-sha256 is worse (although I doubt that it is
significantly so). Granted, I'm probably reading a lot more nuance into
the specification than many readers are.
>
> That being the case, why do we think people will pay attention to a
> MUST NOT today?

Because implementations will stop supporting rsa-sha1, forcing the issue
for any who upgrade. I'm all for having them stop supporting signing
with rsa-sha1, but they should continue to support verification for a while.

-Jim