Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usage-02.txt
Jim Fenton <fenton@bluepopcorn.net> Tue, 13 June 2017 14:32 UTC
Return-Path: <fenton@bluepopcorn.net>
X-Original-To: dcrup@ietfa.amsl.com
Delivered-To: dcrup@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12E131318B9 for <dcrup@ietfa.amsl.com>; Tue, 13 Jun 2017 07:32:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bluepopcorn.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id phiShEeiVMg2 for <dcrup@ietfa.amsl.com>; Tue, 13 Jun 2017 07:32:22 -0700 (PDT)
Received: from v2.bluepopcorn.net (v2.bluepopcorn.net [IPv6:2607:f2f8:a994::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B9F512EAF5 for <dcrup@ietf.org>; Tue, 13 Jun 2017 07:30:50 -0700 (PDT)
Received: from splunge.local ([IPv6:2601:205:8302:79b1:dcef:c2d0:5748:b88a]) (authenticated bits=0) by v2.bluepopcorn.net (8.14.4/8.14.4/Debian-8+deb8u1) with ESMTP id v5DEUl8R013956 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for <dcrup@ietf.org>; Tue, 13 Jun 2017 07:30:49 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bluepopcorn.net; s=supersize; t=1497364249; bh=ibnJ3/DRl0iZ5U0jjg4J2n+Mv8J34/6XKPS4KXC1QcM=; h=Subject:To:References:From:Date:In-Reply-To; b=rgFWogx2+H5hJhkwOrTzgoX45kpdXtd4N0tzXqhHV9MVwGCSrXD0oxAVOLfTdcTgQ GOC6AUmN2q4Dchf3WEuDrvktJFua+ekS1UySka1QPu6E9p242r8K1Q+exq2PX+YJr/ 3K0EAjtF5dAz6764o+E+DMZKtNAXCZjRKZyPwOyc=
To: dcrup@ietf.org
References: <149690083334.25644.8501543904193079634@ietfa.amsl.com> <CABkgnnXDN3One0FZCi63ssMVtnYv-nRRR+_-gLdMMpXzW=hYrQ@mail.gmail.com> <CAL0qLwakBY+LtrkQEPBKDwCrUg_qk_ZRhexUz_D_mw+dUUo6xQ@mail.gmail.com> <17424575.60yUzU31nn@kitterma-e6430> <CABkgnnWuiydrm9y7PHeUonkdpJ3fV1ybbH5uBZE0tPGHr5mw1w@mail.gmail.com> <CAL0qLwaZOxjii_YHVKN1Xp_vN9w8HP0YOVeyJW1wjsaM8LtAnQ@mail.gmail.com> <CAL0qLwaxF6PvPtRT-qdfB8QUn_vYpYJBYS6SxcA-YH5vZC8ROw@mail.gmail.com>
From: Jim Fenton <fenton@bluepopcorn.net>
Message-ID: <c725f1b8-658d-2151-4cfa-811fe56bafc7@bluepopcorn.net>
Date: Tue, 13 Jun 2017 07:30:42 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <CAL0qLwaxF6PvPtRT-qdfB8QUn_vYpYJBYS6SxcA-YH5vZC8ROw@mail.gmail.com>
Content-Type: multipart/alternative; boundary="------------131FFC37E66BD73F324423F0"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/IQAuyLvJla9_jEbpKrTxV4F8M0U>
Subject: Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usage-02.txt
X-BeenThere: dcrup@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DKIM Crypto Update <dcrup.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dcrup>, <mailto:dcrup-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dcrup/>
List-Post: <mailto:dcrup@ietf.org>
List-Help: <mailto:dcrup-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dcrup>, <mailto:dcrup-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Jun 2017 14:32:24 -0000
On 6/13/17 6:46 AM, Murray S. Kucherawy wrote: > On Tue, Jun 13, 2017 at 6:32 AM, Murray S. Kucherawy > <superuser@gmail.com <mailto:superuser@gmail.com>> wrote: > > "Since SHA1 is a deprecated hash algorithm generally, DKIM's > 'rsa-sha1' algorithm is as well (see [John's draft] which changes > its status in the IANA registry), and thus verifiers therefore > ignore signatures that use this algorithm." > > > Uh... we can vote on "thus" or "therefore". (*shame*) :) But "verifiers ignore signatures" doesn't seem like very good normative language. Are they required to (MUST) or is it a strong (SHOULD) or weaker (MAY) suggestion? Since we have seen that there are still a lot of rsa-sha1 signers out there, encouraging verifiers to ignore those signatures (and implementers not to provide rsa-sha1 verification), in the absence of something that is likely to be exploitable, flies in the face of interoperability. Cutting off verification is a lever that should be used only after having said that they SHALL not sign with rsa-sha1, and the current spec doesn't say that. -Jim
- [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usage-0… internet-drafts
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Russ Housley
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Mark D. Baushke
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… John Levine
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Martin Thomson
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Eric Rescorla
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… John R Levine
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Martin Thomson
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Eric Rescorla
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Phillip Hallam-Baker
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Salz, Rich
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Salz, Rich
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Salz, Rich
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Jim Fenton
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Scott Kitterman
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Martin Thomson
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Jim Fenton
- Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usa… Murray S. Kucherawy
- Re: [Dcrup] stronger crypto, I-D Action: draft-ie… Phillip Hallam-Baker