Re: [Dcrup] rsa-sha1 usage

[Phillip Hallam-Baker <[e-mail]>]

The issue of trust lifetime is now very problematic due to the use
DKIM signatures are being put to. In particular the verification of
purported leaks from the DNC and other places.

The DNC material was verified by means of the DKIM signatures. Other
material has been exposed as fake by the lack of signatures. And
please, let us not get into idiot discussions of whether people who
hack into politicians email might redact, suppress or forge material,
of course they would. People who use dishonest tactics are going to do
anything they can get away with and no, nobody is going to be able to
guarantee the material is genuine without a mechanism such as DKIM.

As it stands, the break in SHA-1 is not sufficient to introduce a
forgery but could certainly be used for mischief (if you can't see
how, you lack imagination). Remember that in this campaign, the
opponent is hacking into infrastructure because simply planting a seed
of doubt serves their malignant ends.

So the SHA-1 issue is very clearly a security issue. It is in fact a
critical national security issue. The question is what to do about it.


I suggest the following:

Signers MUST NOT use SHA-1 or RSA 1024.
Verifiers MAY accept SHA-1 or RSA 1024.

The rationale here is that you do not get better security from
introducing a new algorithm. You only improve security by withdrawing
an insecure algorithm.