Re: [Dcrup] Review of draft-ietf-dcrup-dkim-crypto-03

[Eric Rescorla <[e-mail]>]

On Sun, Jul 9, 2017 at 8:02 PM, Peter Goldstein <[e-mail]> wrote:

> Moreover, QC isn't the only possible event that could cause us to wish to
>> have larger keys. There might be a modest improvement in dlog that would
>> make Curve25519 problematic but Curve448 or P-521 comfortable (indeed, this
>> is how we got to the point where we wish to have RSA keys > 1024).
>
>
>>
> Support for larger keys isn't the issue at hand.  The issue is the 255
> character limit imposed by the DNS crudware.  And I think keys for each of
> those curves easily fit under the limit.
>

I'm referring to the claim that hashing doesn't provide any value. For any
curve > 256 bits, it does.


As for QC, I think John's point earlier in the thread isn't that QC will
> require larger keys - but rather than real QC would require fundamental
> reconsideration of DKIM as a whole.
>

It's not clear to me why that would be true, given that the target for
post-quantum algorithms is to have them be drop-in replacements for the
existing algorithms, albeit with inferior performance.

-Ekr


> Best,
>
> Peter
>
> --
>
>
> [image: logo for sig file.png]
>
> Bringing Trust to Email
>
> Peter Goldstein | CTO & Co-Founder
>
> [e-mail]
> +1.415.793.5783 <(415)%20793-5783>
>