Re: [Dcrup] rsa-sha1 proposals

[Hector Santos <[e-mail]>]

On 6/20/2017 7:53 PM, Jim Fenton wrote:

> I agree that the document should say that signers MUST NOT sign using
> SHA-1. Even though SHA-1 hasn't been broken seriously enough to be
> exploitable in this application, it's good for us to be out in front
> of that.
>
> Several people have said that it doesn't matter whether we say MUST
> NOT verify rsa-sha1 or SHOULD NOT verify rsa-sha1. That may very well
> be true, but we shouldn't be in the habit of saying MUST NOT for
> something that is actively being used and is not currently
> exploitable. We should be paying at least lip service to
> interoperability by saying MUST NOT sign prior to saying MUST NOT verify.
>
> Any signers that are concerned about downgrade attacks (bad actors
> creating valid rsa-sha1 signatures somehow, despite the domain using
> rsa-sha256) should put h=sha256 in their key records to close that
> possibility.

+1.

If the document were to suggest "Keep in mind, future Verifiers MAY 
NOT support SHA1"  then this may enough of an incentive for new and 
old signers to begin avoiding SHA1, even for the smallest of DKIM 
applications.

The "higher coverage" verifier will most likely keep SHA1 simply to 
avoid any future support issues. Therefore, it would really help via 
policy to give the verifier what is to be expected.  The key "h=" 
protocol information should be updated to help in this area.


-- 
HLS