Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usage-00.txt

[Scott Kitterman <[e-mail]>]

On Monday, June 05, 2017 01:18:13 PM Murray S. Kucherawy wrote:
> On Mon, Jun 5, 2017 at 9:53 AM, Scott Kitterman <[e-mail]>
> 
> wrote:
> > I hear you.  I expect this to be the most contentious part of the draft.
> > 
> > Here's my counter argument:
> > 
> > The first DKIM RFC (RFC 4871), published in 2007 said:
> > > Signers MUST implement and SHOULD sign using rsa-sha256
> > 
> > I believe that the only reason rsa-sha1 was included at all was to make
> > transition from domainkeys easier (see RFC 4870).  That's also (as I
> > understand it where the 512 bit minimum key size came from).
> 
> As I recall, there were also implementations of DKIM made during its
> development (even before its IETF time) that supported both, and defaulted
> to rsa-sha1 because support for SHA256 in OpenSSL was new and not
> universally deployed.  Some of them were still running in the wild, and
> SHA1 wasn't fully deprecated, so the choice was made to be inclusive while
> encouraging use of the newer stuff as much as possible.
> 
> > As a working group document editor, I'll change it however the group wants
> > (of
> > course), but I think we should either kill rsa-sha1 entirely in this
> > document
> > or leave it out entirely and let one of the follow-on documents add a new
> > algorithm and remove rsa-sha1.  Preferably a clean kill or, failing that,
> > not
> > at all is what I think we should do.
> 
> I would omit it from the updated version entirely, and mark it "obsolete"
> in the registry.
> 
> -MSK, from the floor

OK.  Unfortunately I mashed the upload button on -01 before I saw this, but 
that makes sense to me.  I'll do it for -02.  

Unfortunately the draft submission site got confused about me being me, so I'm 
waiting for an email to confirm it's OK to change the author of the draft from 
me to me, so it may be a few minutes before it shows up.

Thanks,

Scott K