Re: [Dcrup] rsa-sha1 usage

[Scott Kitterman <[e-mail]>]

On Wednesday, June 14, 2017 04:53:37 AM Murray S. Kucherawy wrote:
> On Tue, Jun 13, 2017 at 9:18 PM, Jim Fenton <[e-mail]> wrote:
> > As Pete Resnick loves to point out, RFC prose can be normative without
> > using RFC2119 words.
> > 
> > The text of RFC2119 counsels against unnecessary use of the words it
> > defines.  It also contains this language: "...actually required for
> > interoperation" (which use of rsa-sha1 clearly does not impede) "or to
> > limit behavior which has potential for causing harm".  I suppose this
> > latter is the key issue.
> > 
> > 
> > With respect to whether you need to include the MUST NOT (a point you made
> > earlier), I'll defer to whatever the accepted practices are on the
> > wording.
> > 
> > But WRT the potential to cause harm, I refer to ekr's comment:
> > 
> > Well, this would require a second preimage. My sense is that nobody is
> > close to that at all with SHA-1....
> > 
> > which I interpret as little potential for causing harm in the near future.
> 
> This actually leads me to believe that there's no urgency to deprecate
> rsa-sha1 at all.

The thing about surprises is that they don't show up when expected.  Given we 
have rsa-sha256 and want to add another algorithm, taking the MUST NOT sign 
step now for rsa-sha1 so it's a short putt to remove it entirely when such a 
weakness is unearthed is a prudent step forward.

Scott K