Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-crypto-03.txt

["John R Levine" <[e-mail]>]

> I agree with ekr on this one: publishing a key fingerprint is the more general solution, even if right now we can't think of keys that require it other than RSA. So why not, in the future, always publish key fingerprints?

1)  For the next decade or so, to the extent anyone uses a signature other
    than plain rsa, I expect they'll use eddsa since it's faster than rsa
    and the keys are smaller.  (Librariess will have the code since they
    need it to verify other people's signatures, the only question is
    whether they use it, just like sha-1 and sha-256 body hashes now.)
    Key hashes use more time and space while providing no benefit to eddsa
    signatures.  It doesn't seem like great design to pessimize the common
    case.

B)  Barring surprises, eddsa should be good enough to last as long as DKIM
    does.  But if we have surprises, they tend to be, you know, surprising.
    Maybe we'll switch to some other elliptic curve which has keys smaller
    than 1100 bits, in which case key hashes still have no benefit.  Or
    maybe some mega-parellel rainbow table scheme will come out of left
    field and we'll deprecate all of the sha-N hashes.  It doesn't seem
    like great design to plan for stuff that we can't predict and that will
    probably never happen.  Our crystal ball has never been great: back in
    2006 would anyone have suggested that crudware that can't handle
    multi-string TXT records would be a design issue a decade later?

iii)  It seems unliely that Cisco will assert your patent, but until they
    say something one way or the other, who knows.  It'd be prudent to be
    prepared for the eventuality, particularly since it costs us nothing to
    do so.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly