Re: [Dcrup] FW: IETF WG state changed for draft-ietf-dcrup-dkim-usage

["Murray S. Kucherawy" <[e-mail]>]

On Sat, Aug 19, 2017 at 12:46 PM, Scott Kitterman <[e-mail]>
wrote:

> On Saturday, August 12, 2017 09:58:30 PM Salz, Rich wrote:
> > At the IETF meeting last month there was strong consensus to have MUST
> NOT
> > for both generate and verify using SHA-1.  The discussion on the list had
> > one major participant opposed, who removed their objection once they
> > understood there were two separate documents.
> >
> > Therefore, we are entering a one-week WG last call.
> >
> > (Seth, please start preparing your shepherd writeup :)
> >
> >
> > On 8/12/17, 5:55 PM, "IETF Secretariat" <[e-mail]
> >
> > wrote:
> >
> >
> >     The IETF WG state of draft-ietf-dcrup-dkim-usage has been changed to
> "In
> > WG Last Call" from "WG Document" by Rich Salz:
> >
> >     https://datatracker.ietf.org/doc/draft-ietf-dcrup-dkim-usage/
>
> We're within a few hours of the week being up and the rate of additional
> commentary has fallen to nil, so I took a crack at updating based on the
> last
> call comments.  I'm attaching an rfcdiff of what I would propose as a
> post-LC
> -04, but won't upload it until I get some direction.
>

Hard to tell since the colors showing what's changed aren't rendering for
me, but it looks like it's going in the right direction.

Only a couple of minor things with this version:

- Section 4.1 gives no guidance to verifiers about what to do with smaller
keys.  It only says it should be able to verify signatures generated with
>= 1024-bit keys.  Do we want to say SHOULD NOT accept smaller keys?
Otherwise, I can accept a 512-bit key and be compliant.  I realize it also
says the thing about local policy, so we're covered as-is, but I'm
surprised we're not sending a stronger message on this point like we did
everything else.

- Section 6 shouldn't change the Reference column for rsa-sha1 since the
place it's actually defined isn't changing.  We're only changing the Status
column of that entry. As for John's question about what the value should
be, Section 7 of RFC6376 stipulates that it has to be either "active" or
"historic", so that's our answer there.

Late last week I met with Seth, who's getting his process feet wet by
shepherding this one, and we went through the process.  He should be
submitting his writeup and/or contacting Scott either offline or via the
list to mention anything outstanding.  Once he submits his final writeup we
can send it along to Alexey.

-MSK