Re: [Dcrup] draft-ietf-dcrup-dkim-crypto-00

[Russ Housley <[e-mail]>]

>> I suggest that 2048 bit RSA be considered the minimum key size.
>> Samller sizes are not really safe these days.
> I'm surprised to hear this.  Remember that DKIM signatures are
> relatively low value and not intended to be archival.  They're
> typically verified within a day of being signed, and the design
> encourages key rotation (although I admit that in practice most people
> don't rotate very often.)
> 
> How much effort does it take to crack a 1k signature?

NIST has told everyone to move away from SHA-1 for for all uses except HMAC-SHA-1.

NIST has told everyone to move toward RSA with 2048 bit keys, even for entity authentication applications like DKIM.

If RSA keys of that size are a problem, then it it time to start the transition to Elliptic Curve.  We know it will not happen the day the RFC gets published.

Russ