Re: [Dcrup] draft-ietf-dcrup-dkim-crypto-00

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>Hi,
>
>I suggest that 2048 bit RSA be considered the minimum key size.
>Samller sizes are not really safe these days.

I'm surprised to hear this.  Remember that DKIM signatures are
relatively low value and not intended to be archival.  They're
typically verified within a day of being signed, and the design
encourages key rotation (although I admit that in practice most people
don't rotate very often.)

How much effort does it take to crack a 1k signature?


>In any update of RSA, you really need to determine if your RSA keys will
>be using RSASSA-PSS or PKCS#1 v1.5 padding and be careful in the
>signature verification methods being used as well as specifying the use
>of the SHA2 hash to be used if the key size is greater than RSA 3072
>which is the largest that should probably use SHA2-256. RSA key sizes in
>excess of 3072-bit keys may want to consider SHA2-384 or SHA2-512
>hashes.

I don't purport to be a crypto expert and haven't a clue.  In practice
people use whatever "openssl genrsa" provides.  I'm not too worried
about keys bigger than 3K since I expect that by the time 2K keys
are too weak, people will migrate to a different algorithm.

>I note that you are suggesting signing using ECDH and wonder if you
>intended to specify ECDSA or EdDSA as a way to digitally sign using
>Elliptic Curve methods as generally ECDH is used for key agreement
>protocols.

Beats me.  What should we use to maximize interoperability and have
lots of free libraries ready to use?

R's,
John