Re: [Dcrup] I-D draft-ietf-dcrup-dkim-crypto-06

[Jim Fenton <[e-mail]>]

On 9/15/17 10:15 PM, John Levine wrote:
> In article <1739837.QWERb01LVO@kitterma-e6430> you write:
>>> As far as I can tell, this is about as done as it's going to get.
>> Do we really need to add both rsafp and ed25519?
>>
>> I thought we had ~agreed (or at least discussed) earlier to only add ed25519 
> In July I proposed only doing EC but there was no consensus.  I would prefer
> not to rerun old arguments unless we have learned something new in the meantime.

I haven't found your proposal, but I asked on Jabber at the Prague
meeting whether one or the other would suffice, and repeated that
question on the list. See thread "Do we need both hashed RSA and
elliptic curves?" that begins on 21 July. There were responses from 7
people including you, and I didn't see anyone arguing that we should
have both (although it's not my place to judge consensus).

We would be doing a disservice if we require everyone to support two
ways of solving the key length problem unless there is a compelling
reason to do so.

I also support the use of elliptic curve signatures rather than rsafp.
Part of the reason is that rsafp may have IPR issues (see disclosure
3025). AFAIK EC signatures avoid this problem unless the selector DNS
record contains a hash of the public key, which shouldn't be necessary
because the key is shorter. I have no opinion on the choice of curve used.

-Jim