Re: [Dcrup] New algorithm availability was: Re: draft-ietf-dcrup-dkim-crypto-00

[Scott Kitterman <[e-mail]>]

On Friday, May 19, 2017 05:20:43 PM Salz, Rich wrote:
> > Generally, yes, but DKIM verifiers don't support it currently, so for this
> > purpose, not yet.
> 
> This issue of "we need to move forward; we have an installed base" is not
> new.  RSA2K doesn't fit in many DNS TXT records, so I think that will be an
> additional driver to upgrade.  You may disagree.

I agree there will be drivers to upgrade, but regardless of the drivers, 
upgrades take time.  I think we have two problems to address:

1.  What can be done within the scope of deployed software that was developed 
based on the RFC 6376 requirements (which can be deployed now)

2.  What should be done to modernize crypto for DKIM for the longer term that, 
while it will require software upgrades, will keep DKIM fit for purpose for a 
long (FSVO long) time.

I think they both are important.  I think the first one is really easy to 
specify and cross off the list (I am personally very interested in being able 
to tell people "No, I don't have to verify your 512 bit key.  RFC 6376 has 
been updated by RFC XXXX.  Please join the latter half of the second decade of 
the 21st century).

It's likely we disagree less than I infer you imagine.

Scott K