Re: [Dcrup] rsa-sha1 usage

[Scott Kitterman <[e-mail]>]

On June 13, 2017 11:20:42 PM EDT, Jim Fenton <[e-mail]> wrote:
>On 6/13/17 8:16 PM, Murray S. Kucherawy wrote:
>> On Tue, Jun 13, 2017 at 6:55 PM, Jim Fenton <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>>>     That being the case, why do we think people will pay attention
>to
>>>     a MUST NOT today?
>>
>>     Because implementations will stop supporting rsa-sha1, forcing
>the
>>     issue for any who upgrade. I'm all for having them stop
>supporting
>>     signing with rsa-sha1, but they should continue to support
>>     verification for a while.
>>
>>
>> We can't have this logic both ways.  Scott claimed nobody pays
>> attention to the advice in RFCs ("Operational practice​ isn't closely
>> coupled with standards changes").  If that's true, then there's no
>> meat to a MUST NOT anyway, and it really only matters what people
>will
>> implement.  And if that's true, then saying current implementations
>> neither sign with nor verify "rsa-sha1" because it's deprecated
>> suffices, and we're done.
>
>Based on no supporting data whatsoever, my conjecture is that
>implementers pay a lot more attention to what RFCs say than people who
>are deploying others' implementations. Which basically boils down to
>MUSTs having a significant effect and SHOULDs having little. Which is
>why I favor making signing with rsa-sha1 a MUST NOT prior to making
>verification of rsa-sha1 signatures a MUST NOT.
>
>-Jim

I agree on the importance of MUST versus SHOULD to implementors.  In general terms, MUST tells me what I have to implement and SHOULD tells me the defaults.

I still think we should MUST NOT both signing and verification for rsa-sha1 if for no other reason than to not require implementations to support three algorithms, but I am starting to get the sense I'm in the rough on that.

Scott K