Re: [Dcrup] rsa-sha1 proposals

[Scott Kitterman <[e-mail]>]

On June 20, 2017 8:24:55 PM EDT, Hector Santos <[e-mail]> wrote:
>
>On 6/20/2017 7:53 PM, Jim Fenton wrote:
>
>> I agree that the document should say that signers MUST NOT sign using
>> SHA-1. Even though SHA-1 hasn't been broken seriously enough to be
>> exploitable in this application, it's good for us to be out in front
>> of that.
>>
>> Several people have said that it doesn't matter whether we say MUST
>> NOT verify rsa-sha1 or SHOULD NOT verify rsa-sha1. That may very well
>> be true, but we shouldn't be in the habit of saying MUST NOT for
>> something that is actively being used and is not currently
>> exploitable. We should be paying at least lip service to
>> interoperability by saying MUST NOT sign prior to saying MUST NOT
>verify.
>>
>> Any signers that are concerned about downgrade attacks (bad actors
>> creating valid rsa-sha1 signatures somehow, despite the domain using
>> rsa-sha256) should put h=sha256 in their key records to close that
>> possibility.
>
>+1.
>
>If the document were to suggest "Keep in mind, future Verifiers MAY 
>NOT support SHA1"  then this may enough of an incentive for new and 
>old signers to begin avoiding SHA1, even for the smallest of DKIM 
>applications.
>
>The "higher coverage" verifier will most likely keep SHA1 simply to 
>avoid any future support issues. Therefore, it would really help via 
>policy to give the verifier what is to be expected.  The key "h=" 
>protocol information should be updated to help in this area.

I think just using the tag in key records operationally is all that's needed.

Also, when it comes to migration away from rsa-sha1, it looks like you're one of the ones with work to do:

DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1;

Scott t