Re: [Dcrup] rsa-sha1 usage

Well, this would require a second preimage. My sense is that nobody is
close to that at all with SHA-1....

-Ekr

On Tue, Jun 13, 2017 at 3:41 PM, Jim Fenton <fenton@bluepopcorn.net> wrote:

> On 6/13/17 5:05 AM, Salz, Rich wrote:
>
> As a newcomer to DKIM (I come from the crypto side of things) I am a bit
> confused.
>
>
>
> Certificates last for a couple of years, and so there was a strong
> motivation to move off MD5 and then SHA1, because of the concern that
> someone would find a collision and create a bogus certificate during the
> original cert’s lifetime.
>
>
>
> But I’ve heard that DKIM “trust lifetime” is much shorter.  Is it?  What
> is the expected lifetime for relying on a DKIM signature?
>
>
> The expected lifetime is on the order of a week (message delivery
> timeout). But the signature doesn't have an expiration time, so if someone
> can construct a second message with the same hash, they could replay the
> signature, potentially much later if the public key is still in DNS.
>
> IMO it seems very unlikely, even with the known weaknesses in SHA-1, that
> in the near future someone would be able to construct such a message that
> would be exploitable by an attacker (e.g., spam or a phishing attack). That
> will likely change in the future, so we should tell signers to stop using
> SHA-1 ASAP and tell verifiers to stop accepting those signatures sometime
> later.
>
> If anyone knows something yet more serious about exploitability of
> rsa-sha1, please set me straight.
>
> -Jim
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup
>
>