Re: [Dcrup] rsa-sha1 usage

Scott Kitterman <sklist@kitterman.com> Mon, 12 June 2017 23:51 UTC

Return-Path: <sklist@kitterman.com>
X-Original-To: dcrup@ietfa.amsl.com
Delivered-To: dcrup@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B9DF129447 for <dcrup@ietfa.amsl.com>; Mon, 12 Jun 2017 16:51:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=kitterman.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t8eNJE-I3HNL for <dcrup@ietfa.amsl.com>; Mon, 12 Jun 2017 16:51:27 -0700 (PDT)
Received: from mailout03.controlledmail.com (mailout03.controlledmail.com [IPv6:2607:f0d0:3001:aa::2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1FCE129426 for <dcrup@ietf.org>; Mon, 12 Jun 2017 16:51:26 -0700 (PDT)
Received: from android-df929938bd25e485.home.kitterman.com (static-72-81-252-22.bltmmd.fios.verizon.net [72.81.252.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mailout03.controlledmail.com (Postfix) with ESMTPSA id CA053C403A4; Mon, 12 Jun 2017 18:51:25 -0500 (CDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=kitterman.com; s=201409; t=1497311485; bh=YRRaTqsa6GvNZ/DS0TcBiiRogAaHDBiLf1ikfQlCb9Y=; h=Date:In-Reply-To:References:Subject:To:From:From; b=a+MsiWq5Hmx3aCBSUKeiCNeVUnS2nyzwDcihpME8+Wg1NjN6frcYV8jyEbLDTuuI+ MQInmCmiPYls2BHS1wn0ZfQhq9Z1XMGYHUDdU1qCy8Ks7eFZkKx7Cy24bUkHqKRB9S ffcW4wzegM07fqwz2MFAS8eAHowksm00OaxbPUcw=
Date: Mon, 12 Jun 2017 23:51:24 +0000
In-Reply-To: <CABa8R6s6rzc+Ky8sLWcK7NtforSksEhNRkWVeF=k1v8GC80knw@mail.gmail.com>
References: <m38tkw53bd.fsf@carbon.jhcloos.org> <CABa8R6s6rzc+Ky8sLWcK7NtforSksEhNRkWVeF=k1v8GC80knw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
To: dcrup@ietf.org
From: Scott Kitterman <sklist@kitterman.com>
Message-ID: <5B2CFEEC-9A44-4368-A6BE-24CDF69D01C0@kitterman.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/mRgo0vIItlpfEIIUZZxb3T7CYnQ>
Subject: Re: [Dcrup] rsa-sha1 usage
X-BeenThere: dcrup@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DKIM Crypto Update <dcrup.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dcrup>, <mailto:dcrup-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dcrup/>
List-Post: <mailto:dcrup@ietf.org>
List-Help: <mailto:dcrup-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dcrup>, <mailto:dcrup-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Jun 2017 23:51:29 -0000

How are messages that are signed with both rsa-sha1 and rsa-sha256 counted?  For this purpose they should be in the rsa-sha256 pile.

Scott K

On June 12, 2017 7:25:28 PM EDT, Brandon Long <blong@google.com> wrote:
>It would be good to know where the source is, ie if its say the default
>in
>opendkim or something, then hopefully a change to that would eventually
>hit
>these.
>
>We don't currently log the algorithm, guess we can change that to take
>a
>look.
>
>Brandon
>
>On Mon, Jun 12, 2017 at 2:00 PM, James Cloos <cloos@jhcloos.com> wrote:
>
>> I looked at a corpus of email from this year.  3265010 emails,
>> including all of spam, good automated and good from humans.
>>
>> The vast majority of the latter were deliverred via mailing lists.
>>
>> Just under half (1443757) had a dkim sig.
>>
>> The ratio of rsa-sha256 to rsa-sha1 was 1244650:198495 which reduces
>> to about 6.270:1.
>>
>> So there is a ways to do before sha1 signers disappear.
>>
>> Nonetheless, I still agree that the update should deprecate sha1.
>>
>> -JimC
>> --
>> James Cloos <cloos@jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6
>>
>> _______________________________________________
>> Dcrup mailing list
>> Dcrup@ietf.org
>> https://www.ietf.org/mailman/listinfo/dcrup
>>