Re: [Dcrup] rsa-sha1 proposals

[Hector Santos <[e-mail]>]

On 6/20/2017 8:43 PM, Scott Kitterman wrote:
> On June 20, 2017 8:24:55 PM EDT, Hector Santos <[e-mail]> wrote:
>>
>> The "higher coverage" verifier will most likely keep SHA1 simply to
>> avoid any future support issues. Therefore, it would really help via
>> policy to give the verifier what is to be expected.  The key "h="
>> protocol information should be updated to help in this area.
>
> I think just using the tag in key records operationally is all that's needed.
>
> Also, when it comes to migration away from rsa-sha1, it looks like you're one of the ones with work to do:
>
> DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1;
>

Plus any customers who decided to keep a lower overhead DKIM/SHA1 
email operation running for their setup.  Its just a simple switch for 
us, but I am thinking about the "other legacy endpoints" and the 
customers who may encounter new "support issues" because of an update 
to a version where SHA1 support may have been removed.  Therefore I 
can't turn it off even I changed it for my own setup. But I can help 
with a new possible migration/enforcement option such as:

    [X] If Key has "h=sha256", invalidate an SHA1 signed message
         from the signer domain.

And with a protocol change note such as:

      "Notes: 1) Future Verifiers MAY NOT include support SHA1.

              2) If the signer domain key has "h=sha256" then
                 any signed message not sha256 SHOULD be
                 invalidated.

it should be incentive for signers to begin avoiding sha1 and new 
defaults for signer setups with will be SHA256.

But I think it is important for such language as #2 because this is 
both a security and a migration problem.   If we are here to seek a 
change, then signers needs a quick way to tell verifiers to 
discard/invalidate SHA1 signatures.

-- 
HLS