Re: [Dcrup] rsa-sha1 usage

[Jim Fenton <[e-mail]>]

On 6/13/17 5:05 AM, Salz, Rich wrote:
>
> As a newcomer to DKIM (I come from the crypto side of things) I am a
> bit confused.
>
>  
>
> Certificates last for a couple of years, and so there was a strong
> motivation to move off MD5 and then SHA1, because of the concern that
> someone would find a collision and create a bogus certificate during
> the original cert’s lifetime.
>
>  
>
> But I’ve heard that DKIM “trust lifetime” is much shorter.  Is it? 
> What is the expected lifetime for relying on a DKIM signature?
>

The expected lifetime is on the order of a week (message delivery
timeout). But the signature doesn't have an expiration time, so if
someone can construct a second message with the same hash, they could
replay the signature, potentially much later if the public key is still
in DNS.

IMO it seems very unlikely, even with the known weaknesses in SHA-1,
that in the near future someone would be able to construct such a
message that would be exploitable by an attacker (e.g., spam or a
phishing attack). That will likely change in the future, so we should
tell signers to stop using SHA-1 ASAP and tell verifiers to stop
accepting those signatures sometime later.

If anyone knows something yet more serious about exploitability of
rsa-sha1, please set me straight.

-Jim