IETF Logo Mail Archive

Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-crypto-03.txt

denis bider <denisbider.ietf@gmail.com> Tue, 04 July 2017 00:49 UTC

Return-Path: <denisbider.ietf@gmail.com>
X-Original-To: dcrup@ietfa.amsl.com
Delivered-To: dcrup@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22EFE126E3A for <dcrup@ietfa.amsl.com>; Mon, 3 Jul 2017 17:49:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n74B85u9WgMY for <dcrup@ietfa.amsl.com>; Mon, 3 Jul 2017 17:49:50 -0700 (PDT)
Received: from mail-yb0-x235.google.com (mail-yb0-x235.google.com [IPv6:2607:f8b0:4002:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CAE512741D for <dcrup@ietf.org>; Mon, 3 Jul 2017 17:49:50 -0700 (PDT)
Received: by mail-yb0-x235.google.com with SMTP id s15so25536927ybe.2 for <dcrup@ietf.org>; Mon, 03 Jul 2017 17:49:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=HDAZItAbRmsnalg7VJMtqQ5tBcycFGg7NtpemJeAMcI=; b=BF0BjiqOtLHG2fizMtYdIc0sIBJY/XHkesm0CVMppBMN9hnkgslLGjFzx34Sukodo7 umiAICnjmknwstgtIfjts64PZd5vBr6ET6pK5ZWq5emaVX9rmu8LaN5+oshg03ROfzdq ufSNlhaoDdmPfG8Osp4X3pKq8+Wjo25uFMuGAOXdm19GFeuNz3HFPZp9V7KadGrPYcyS MRXzN/v9X9REf5e2N4Iq12Bbj393PAH/GSSipAXjrXKNqAHBphu6nj0oVVXa9GK6r4yk u2r8sD7paQGgcTK8hvhJqnulxAjeVVNP8T8J16PGhrTdIyoUBDR3pP9jTPsPj6QRkCzo Wnmw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=HDAZItAbRmsnalg7VJMtqQ5tBcycFGg7NtpemJeAMcI=; b=RegJwx13yDUXJZHkxWFCCJhxMwkgq2rwI/UPKY/RAGw/M+bP4GUTahRpl01Si5m3Ap 6rkkxc4davFUz+SpW6G6BnR+cHaufpfYtOhDfAcd6rJIUYQwh265+voUKm/FLhnuqrkA QaeuN+M0bp7qV2g1G5kKmd1d5Nz7mHA3gThAVtKVitRZ+BQZNEqHJbogjsbZ/a2j2blo jxhwlnUKNoO1tD3BXI9OsAUL3xZKul/K7z1PbNBs3qKeCXnLRAifuMDhue5qgXpwZCdG xAynQSphYAgBxD1X402+MJdMkm/aZjx1kveBOla6fx2Xo0hXxsjubxB75QLuMPKpaen5 dfcw==
X-Gm-Message-State: AKS2vOwGGkgLbzbbljpj0iTa97IOhz2sJShErtv0XuWc9rTkKYCzjS5t z8NeL+DJP867P49nd0QL58T1nQyAEQ==
X-Received: by 10.37.205.133 with SMTP id d127mr30490998ybf.215.1499129388881; Mon, 03 Jul 2017 17:49:48 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.37.174.92 with HTTP; Mon, 3 Jul 2017 17:49:48 -0700 (PDT)
In-Reply-To: <CABcZeBPu-hD+0z4_7zJuU_kUog47q6bUf3Cm76L+pyCXgkVGQw@mail.gmail.com>
References: <CABcZeBOs1yZ7q3oBgNeVkw=zSQb_SuS4hqK8BH0ebrD5LRYTFg@mail.gmail.com> <20170702025650.55902.qmail@ary.lan> <CABcZeBM4KEr5CEZq4t9BX50btCRPLhZBAtZN18v_6gZ5B-ni5A@mail.gmail.com> <alpine.OSX.2.21.1707012341180.70305@ary.qy> <CABcZeBOLSrYo8mEQ1evyU7CzctV0VF4r7_bX3nA0oxtHCeEgSQ@mail.gmail.com> <alpine.OSX.2.21.1707021544590.72907@ary.qy> <CABcZeBPbL9EgZhF9t6j1Nt9xU=97oNj1ssaVFaiS8Mgd573evA@mail.gmail.com> <CABcZeBP1w2GPQmfCzQnROunoeXHiB0jodYW7dY3W4tLf5GHDgw@mail.gmail.com> <alpine.OSX.2.21.1707021715300.73525@ary.qy> <CABcZeBPu-hD+0z4_7zJuU_kUog47q6bUf3Cm76L+pyCXgkVGQw@mail.gmail.com>
From: denis bider <denisbider.ietf@gmail.com>
Date: Mon, 03 Jul 2017 18:49:48 -0600
Message-ID: <CADPMZDD63EWUQcBBnwV_esRoqPqcBujWBzj3qX3sr_JExwJFBg@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Cc: John R Levine <johnl@taugh.com>, dcrup@ietf.org
Content-Type: multipart/alternative; boundary="94eb2c189eecb265c6055373426a"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/Kwb90gz3JGd0UQVxsX3ee5ceDUE>
Subject: Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-crypto-03.txt
X-BeenThere: dcrup@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DKIM Crypto Update <dcrup.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dcrup>, <mailto:dcrup-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dcrup/>
List-Post: <mailto:dcrup@ietf.org>
List-Help: <mailto:dcrup-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dcrup>, <mailto:dcrup-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Jul 2017 00:49:52 -0000

I agree with John's reasoning, and the +1 from Scott K, and think this
request is unwarranted. I see no gain from reverting this removal.

The current design defines algorithms on a case-by-case basis. Both X25519
and X448 have keys small enough to be represented without hashing. Hashed
keys cannot be made default at this point. That ship sailed 10 years ago.
SMTP is a 40 year old protocol. At this point we should all understand that
things are basically forever once they become widely accepted.

2048-bit RSA can be represented as-is unhashed. The only reason unhashed
RSA would therefore go away is if 2048-bit RSA is broken and becomes
deprecated. If that happens, chances are we'll need post-quantum crypto,
and EDDSA will be deprecated as well.

Hashed keys will not be default until post-quantum is a strict requirement,
and we're not in a position to specify that right now. There is no purpose
served by adding "eddsafp".


On Sun, Jul 2, 2017 at 4:02 PM, Eric Rescorla <ekr@rtfm.com> wrote:

>
>
> On Sun, Jul 2, 2017 at 2:16 PM, John R Levine <johnl@taugh.com> wrote:
>
>> I'd also be fine with having both representations, though I think it's
>>> confusing. However, I don't think it's great to have just unhashed in the
>>> future.
>>>
>>
>> Since nobody is currently proposing that, and as far as I can tell nobody
>> in this thread has ever proposed that, I really don't understand what we're
>> arguing about.
>
>
> I'm responding to this change:
> "SIGNIFICANT CHANGE: Only RSA signatures can use key fingerprints.  Since
> an eddsa key is 256 bits, and a SHA-256 fingerprint is also 256 bits,
> there's no point to eddsa fingerprints, so I took them out."
>
> My point is that you should revert it.
>
> -Ekr
>
>
>
>> Regards,
>> John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY
>> Please consider the environment before reading this e-mail. https://jl.ly
>>
>
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup
>
>

v2.28.0 | Report a Bug | By Email | System Status