Re: [Dcrup] rsa-sha1 proposals

[Jim Fenton <[e-mail]>]

On 6/20/17 4:38 PM, Seth Blank wrote:
> On Tue, Jun 20, 2017 at 4:20 PM, Hector Santos <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>         Back in 2007 RFC 4871 said "In general, sha256 should always
>         be used
>         whenever possible."  I think people have had enough warning,
>         and if we
>         want to kill it, we should just kill it.
>
>
>     Unless whitelisted, this will create invalid SHA1 signatures from
>     perfectly good domains.  New systems who initially avoid SHA1
>     legacy support will quickly learn not all systems use SHA256. i.e
>     a quick support problem.
>
>
> To me, this is exactly the point. People have had ten years to switch
> to SHA-256. At this point, people will only move if the threat of
> breakage is upon them. And this isn't breakage, this is a document
> that says using SHA-1 is no longer acceptable, and you MUST use
> SHA-256. If it's the right security recommendation, we should say it
> explicitly.
The verb "use" isn't precise enough because it doesn't specify whether
it refers to signing or verifying.

I agree that the document should say that signers MUST NOT sign using
SHA-1. Even though SHA-1 hasn't been broken seriously enough to be
exploitable in this application, it's good for us to be out in front of
that.

Several people have said that it doesn't matter whether we say MUST NOT
verify rsa-sha1 or SHOULD NOT verify rsa-sha1. That may very well be
true, but we shouldn't be in the habit of saying MUST NOT for something
that is actively being used and is not currently exploitable. We should
be paying at least lip service to interoperability by saying MUST NOT
sign prior to saying MUST NOT verify.

Any signers that are concerned about downgrade attacks (bad actors
creating valid rsa-sha1 signatures somehow, despite the domain using
rsa-sha256) should put h=sha256 in their key records to close that
possibility.

-Jim