Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Scott Kitterman <[e-mail]>]

On Tuesday, January 14, 2020 9:50:58 AM EST Scott Kitterman wrote:
> On Tuesday, January 14, 2020 9:44:08 AM EST Hector Santos wrote:
> > Whether SHA1 usage is 10%, 5% or 1%, we need to remember, it is still
> > part of the protocol and DKIM Verifiers MUST be including SHA1 for
> > verification purposes.
> 
> No.  It's not.  Please review RFC 8301, which updates RFC 6376:
> > 3.1.  Signing and Verification Algorithms
> > 
> >    DKIM supports multiple digital signature algorithms.  Two algorithms
> >    are defined by this specification at this time: rsa-sha1 and
> >    rsa-sha256.  Signers MUST sign using rsa-sha256.  Verifiers MUST be
> >    able to verify using rsa-sha256.  rsa-sha1 MUST NOT be used for
> >    signing or verifying.
> >    
> >    DKIM signatures identified as having been signed with historic
> >    algorithms (currently, rsa-sha1) have permanently failed evaluation
> >    as discussed in Section 3.9 of [RFC6376].
> 
> I know you know this, so please stop pretending it's not true.

At some point you are going to have to actually implement sha-256:

DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1;

You're close to a decade and a half late.

Scott K