Re: [Dcrup] rsa-sha1 proposals

[Brandon Long <[e-mail]>]

On Tue, Jun 20, 2017 at 6:15 PM, Hector Santos <[e-mail]> wrote:

> On 6/20/2017 8:43 PM, Scott Kitterman wrote:
>
>> On June 20, 2017 8:24:55 PM EDT, Hector Santos <[e-mail]> wrote:
>>
>>>
>>> The "higher coverage" verifier will most likely keep SHA1 simply to
>>> avoid any future support issues. Therefore, it would really help via
>>> policy to give the verifier what is to be expected.  The key "h="
>>> protocol information should be updated to help in this area.
>>>
>>
>> I think just using the tag in key records operationally is all that's
>> needed.
>>
>> Also, when it comes to migration away from rsa-sha1, it looks like you're
>> one of the ones with work to do:
>>
>> DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1;
>>
>>
> Plus any customers who decided to keep a lower overhead DKIM/SHA1 email
> operation running for their setup.  Its just a simple switch for us, but I
> am thinking about the "other legacy endpoints" and the customers who may
> encounter new "support issues" because of an update to a version where SHA1
> support may have been removed.  Therefore I can't turn it off even I
> changed it for my own setup. But I can help with a new possible
> migration/enforcement option such as:
>
>    [X] If Key has "h=sha256", invalidate an SHA1 signed message
>         from the signer domain.
>
> And with a protocol change note such as:
>
>      "Notes: 1) Future Verifiers MAY NOT include support SHA1.
>
>              2) If the signer domain key has "h=sha256" then
>                 any signed message not sha256 SHOULD be
>                 invalidated.
>

Isn't that just a truism?  Ie, any signing algorithm may be invalidated in
the future.  We're explicitly trying to move the needle away from SHA-1
right now, not in the future.

Brandon