Re: [Dcrup] Review of draft-ietf-dcrup-dkim-crypto-03

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>What I'm trying to do is reduce the additional complexity of adding new
>algorithms in the future by having a consistent approach going forward.

Given that we will always have code for both hashed and unhashed keys,
since unhashed RSA isn't going away, my minimal complexity approach is
to add an algorithm with unhashed keys if the keys are small, and with
hashed keys if the keys are large.  

Since DKIM has no opportunity for algorithm negotiation, verifiers
have to implement every algorithm that signers might use, so the
main goal is to minimize the number of algorithms, regardless of
what they are.

At this point I'm inclined to take out hashed RSA, since the problem
it solves only exists due to stupid configuration software, and anyone
who implements hashed RSA would also implent EdDSA which doesn't
have the configuration key size problem.

As I read RFC 8032, the chances are pretty good that ed25519 will last
as long as DKIM does, so we won't have to do this again.

R's,
John