[Dcrup] DKIM algorithms

[Jan Dušátko <[e-mail]>]

Hi,
I would like to ask about the near-term development of signature 
algorithms for DKIM. Currently, it is possible to use either RSA or 
Ed25519. When comparing their strength using the security equivalent, 
Ed25519 is on the edge (the recommended security equivalent is currently 
128b). For RSA, it is possible to use a signature of size 3072b, which 
is still not widely supported. Most of solution still support keys with 
size of 2048b.
1) If I have studied RFC well, it is used for RSA signature PKCS#1 v 
1.5, currently I find it more appropriate to use RSA-PSS, i.e. PKCS#2.2 
(RFC 3447). Do I understand this well? Will be possible to allow RSA-PSS 
in such conditions?
2) Given the behavior of elliptic curves, I find it interesting to 
implement Ed448. It is a signature accepted by NIST, ENISA, the curve 
shown and the signature for authentication is also used in TLS 1.3.
3) I see interesting discussion about enforcing of use SHA256. I would 
like to agree, with one point. Implementation can be years after RFC 
advices, which mean that wise altitude to enter "h=sha256" in all DKIM 
keys.
I understand, that implementation will take a long time, but will be 
usefull to use current cryptography and short key which can fit in the 
512B.

There are "raw estimation" of security equivalent.
+-----------+---------------------+
| KEY SIZE  | SECURITY EQUIVALENT |
+-----------+---------------------+
| RSA 1024b |                 96b |
| RSA 2048b |                112b |
| RSA 3072b |                128b |
| RSA 4096b |                160b |
|   Ed25519 |                125b |
|     Ed448 |                224b |
+-----------+---------------------+

And algorithm to hash relation, include obsolete SHA1 function.
+-----------+-----------+
| ALGORITHM |   HASH    |
+-----------+-----------+
| rsa       | sha1      |
| rsa       | sha256    |
| rsa       | sha384    |
| rsa       | sha512    |
| rsa-pss   | sha256    |
| rsa-pss   | sha384    |
| rsa-pss   | sha512    |
| ed25519   | sha256    |
| ed448     | shake256  |
+-----------+-----------+

National Institute of Standards and Technology, "Digital Signature 
Standard (DSS)", FIPS PUB 186-5, DOI 10.6028/NIST.FIPS.186-5, February 
2023, <https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf>
ETSI, "Electronic Signatures and Infrastructures (ESI); Cryptographic 
Suites", ETSI TS 119 312 V1.4.1, August 2021, RTS/ESI0019312v141, 
<https://www.etsi.org/deliver/etsi_ts/119300_119399/119312/01.04.01_60/ts_119312v010401p.pdf> 


Regards

Jan

-- 
-- --- ----- -
Jan Dušátko

Tracker number:	[phone]
e-mail:		[e-mail]
GPG Signature:	https://keys.dusatko.org/E535B585.asc
GPG Encrypt:	https://keys.dusatko.org/B76A1587.asc