Date: Wed, 14 Jun 2017 03:35:35 +0000
In-Reply-To: <CAL0qLwbFE5PzpOWzn-DwQ2D0z0=OAtEJLnwBbq2hk2SK2pc4Bg@mail.gmail.com>
References: <m38tkw53bd.fsf@carbon.jhcloos.org>
 <CABa8R6s6rzc+Ky8sLWcK7NtforSksEhNRkWVeF=k1v8GC80knw@mail.gmail.com>
 <m3wp8gpx20.fsf@carbon.jhcloos.org>
 <CAOj=BA2O+Hf2VGOtbmnqY2M5J9u8uJ7wm7SxEW551SXBwDdanw@mail.gmail.com>
 <5bf52517591d4950aec335d31bcf3631@usma1ex-dag1mb1.msg.corp.akamai.com>
 <aa52134a-ac20-bd70-8834-1598a8eaa536@bluepopcorn.net>
 <29B74569-6BB3-43F8-9549-566DA405B1FF@kitterman.com>
 <CAL0qLwaqPwb+cNhRCWLBp2qjTWtS65JAvstc9GfrhDDXRv+d6w@mail.gmail.com>
 <57fda1d5-b0b7-f226-60db-7f4c47233fc7@bluepopcorn.net>
 <CAL0qLwbFE5PzpOWzn-DwQ2D0z0=OAtEJLnwBbq2hk2SK2pc4Bg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
To: dcrup@ietf.org
From: Scott Kitterman <sklist@kitterman.com>
Message-ID: <182B1730-A277-4E7F-ACFF-F51E766173BB@kitterman.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/mhsKR2gH0Asgl6iA3S3s-Btcq0g>
Subject: Re: [Dcrup] rsa-sha1 usage
Precedence: list



On June 13, 2017 11:16:11 PM EDT, "Murray S=2E Kucherawy" <superuser@gmail=
=2Ecom> wrote:
>On Tue, Jun 13, 2017 at 6:55 PM, Jim Fenton <fenton@bluepopcorn=2Enet>
>wrote:
>
>> That being the case, why do we think people will pay attention to a
>MUST
>> NOT today?
>>
>>
>> Because implementations will stop supporting rsa-sha1, forcing the
>issue
>> for any who upgrade=2E I'm all for having them stop supporting signing
>with
>> rsa-sha1, but they should continue to support verification for a
>while=2E
>>
>
>We can't have this logic both ways=2E  Scott claimed nobody pays
>attention to
>the advice in RFCs ("Operational practice=E2=80=8B isn't closely coupled =
with
>standards changes")=2E  If that's true, then there's no meat to a MUST
>NOT
>anyway, and it really only matters what people will implement=2E  And if
>that's true, then saying current implementations neither sign with nor
>verify "rsa-sha1" because it's deprecated suffices, and we're done=2E

What I should have said is sometimes standards lead and sometimes they fol=
low=2E  Bumping up the minimum RSA key size is the standards community catc=
hing up to what the operational community did half a decade ago=2E  OTOH, I=
 think rsa-sha1 usage will decline once there is strong MUST NOT guidance p=
ublished=2E  Not immediately, but considering the mail system development, =
deployment, upgrade life cycle it's much better to give things a good push =
in that direction now, before its time to panic=2E=2E

Scott K