Re: [Dcrup] Ben Campbell's Yes on draft-ietf-dcrup-dkim-usage-04: (with COMMENT)

[Hector Santos <[e-mail]>]

On 10/19/2017 4:40 AM, Martin Thomson wrote:
> On Thu, Oct 19, 2017 at 6:35 PM, Murray S. Kucherawy
> <[e-mail]> wrote:
>>> -4: "Verifiers MUST verify using rsa-sha256."
>>>
>>> Should this say "...MUST be able to..."? That is, am I correct in assuming
>>> that
>>> a verifier will use the scheme specified by the signer if it is capable of
>>> doing so, and that it doesn't make sense to try to verify with rsa-sha256
>>> if
>>> the signer used something else?
>>
>>
>> I see Ben's point, and "MUST be able to..." sounds reasonable to me.  I
>> think this also addresses Jari's GEN-ART point (to which Mirja alluded), and
>> his "MUST implement" suggestion also seems reasonable to me.
>>
>> What does the WG prefer?
>
> I saw the original requirement as stipulating a policy requirement in
> addition to an implementation requirement.  That is, verifiers need to
> insist on a valid rsa-sha256 signature or the message is considered
> unverified.

+1, but I believe the policy requirement is the DKIM signer domain 
insisting via the public key record using a "h=sha256" tag.  The 
verifier should be ready to invalidate a DKIM sha1 signed message with 
a hash policy mismatch result/error. An SMTP Verifier spawning a 
dynamic DKIM-related protocol check at the DATA state can return a 
permanent negative response code, i.e. 55z.

-- 
HLS