Re: [Dcrup] rsa-sha1 usage

[Seth Blank <[e-mail]>]

On Wed, Jun 14, 2017 at 5:24 AM, Phillip Hallam-Baker <[e-mail]
> wrote:
>
> It is a two step process in my view. First you rip out the generate,
> then once the transition is complete, you rip out the accept.
>

I disagree. SHA-1 has been deprecated for far too long, but is still in
wide use by major players. I'd argue step 1 was taken ages ago (with a
SHOULD, not a MUST, but still...) and we're at step 2 *now* because senders
aren't complying with up-to-date crypto standards on their own.

While a large number of senders may not pay attention to language in an
RFC, in my experience the verifiers have a strong incentive to follow the
RFC language to a tee whenever possible to maximize interoperability. And
the senders don't change unless the receivers make them.

At this point, why don't we call a spade a spade, and say that the only way
to kill SHA-1 in the wild dead is by saying verifiers MUST NOT verify
SHA-1. Then the verifiers will do what they always do, and reach out to
those not playing by standards and say "upgrade your implementation or
it'll start being rejected in 90 days" and letting the problem solve itself.

I believe this is exactly what draft-01 accomplishes.