[Dcrup] Work on draft-ietf-dcrup-dkim-usage

[Scott Kitterman <[e-mail]>]

I have locally updated the draft based on my interpretation of the discussion 
on the list.  Rfcdiff attached.

Added an informative reference to the US-CERT vulnerability report on this 
issue.
Added updates to header field and key records that I missed in my first draft.

Also, I forgot to mention before that, since all the cool kids are doing it, I 
put this up on my github account.  This is, of course, in no way officially 
anything at all.  It's only a way for me to keep track of changes.

https://github.com/kitterma/draft-ietf-dcrup-dkim-usage

I did not take on the question of adding key sizes to the IANA registry for 
several reasons:

1.  Adding it at all is somewhat controversial and I'm hoping to limit the 
controversy in this particular document so we can get it done.  I view this 
document as the minimum update to RFC 6376 required to update DKIM to remove 
known insecure things.  An IANA registry doesn't affect that.

2.  Different types of algorithms have widely different key size requirements, 
so I don't believe we will really know what such a registry would need to look 
like until after we've finished working through questions about what is the 
next generation DKIM algorithm going to be.  Making a registry now would mean 
we might need to redo it later.  Let's do it once, if we are going to to it at 
all.

3.  There is some nuance about key size rules that I'm not sure how to fit 
into an IANA registry.

One other thing that perhaps should go into this draft is more on Security 
Considerations.  If you look at the Security Considerations in RFC 6376, it 
does not mention risks associated with using an obsolete hash algorithm or a 
key that is too small.  Adding a new security consideration as an "update" to 
RFC 6376 that describes the problem this draft is solving might be a good 
thing?

As revisions are cheap, unless someone objects, I'll go ahead and post this 
(or something similar based on feedback) soon.

Scott K