Re: [Dcrup] draft-ietf-dcrup-dkim-crypto-00

It's going to be hard to move straight to 2048 bit RSA as the minimum key
size.

The challenges with 2048 bit RSA are largely an issue of the limitations of
the DNS infrastructure in use by the sending domain.  In some DNS managers,
the Web UIs (and occasionally the underlying infrastructure) don't allow
domain owners to enter records that are larger than 512 octets.  Users of
these DNS managers generally cannot provision 2048 bit key DKIM TXT
records.  That's a problem for self-managed infrastrucutre and email
services that provide TXT records for DKIM.

Also, as far as I'm aware almost none of the existing email service
providers offers the option of a 2048 bit DKIM key out of the box.  For
those systems that use CNAMEs, upgrading to 2048 bit keys will be
relatively straightforward.  But for those that distribute TXT records
(most of them), they will face more of a challenge to upgrade their users
to 2048 bit keys - both because of the above domain limitations and because
they're going to need to get their customers to make DNS changes.

Given the above, Scott's suggested approach for RSA sounds like the right
one - especially if we can combine it with statements from the large
receivers that they will plan to sunset support for 1024 bit keys (much as
they did for 512 bit keys) at some point in the future.  That will both
incentivize domain owners and email services to upgrade their key size to
2048 and give the ecosystem time to adjust.
That said, I think it's also important to start the process of
transitioning to Elliptic Curve.  Defining the updates to the spec, getting
some software to support it (i.e. OpenDKIM), and working with the large
receivers to get them onboard are all steps that can be taken in parallel
with Scott's suggested approach for RSA keys.

Best,

Peter

On Fri, May 19, 2017 at 10:02 AM, Russ Housley <housley@vigilsec.com> wrote:

> >> I suggest that 2048 bit RSA be considered the minimum key size.
> >> Samller sizes are not really safe these days.
> > I'm surprised to hear this.  Remember that DKIM signatures are
> > relatively low value and not intended to be archival.  They're
> > typically verified within a day of being signed, and the design
> > encourages key rotation (although I admit that in practice most people
> > don't rotate very often.)
> >
> > How much effort does it take to crack a 1k signature?
>
> NIST has told everyone to move away from SHA-1 for for all uses except
> HMAC-SHA-1.
>
> NIST has told everyone to move toward RSA with 2048 bit keys, even for
> entity authentication applications like DKIM.
>
> If RSA keys of that size are a problem, then it it time to start the
> transition to Elliptic Curve.  We know it will not happen the day the RFC
> gets published.
>
> Russ
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup
>

-- 

[image: logo for sig file.png]

Bringing Trust to Email

Peter Goldstein | CTO & Co-Founder

peter@valimail.com
+1.415.793.5783