Re: [Dcrup] I-D Action: draft-ietf-dcrup-dkim-usage-02.txt

I find the construction of this draft strange.  Why not simply say
"verifiers MUST implement and use rsa-sha256 instead of rsa-sha1"?
The remainder of the text is largely unchanged, which took me a while
to validate.

The problem here is that removing the definition of rsa-sha1 is not
the point.  The code point can't be undefined (Section 7 gets that
right), and we don't really benefit from having the definition
removed.  What we want is to have rsa-sha256 implemented and deployed.

So say two things, just to be perfectly clear:

1. DKIM implementations MUST NOT rely on rsa-sha1, it's busted.

2. DKIM implementations MUST use rsa-sha256.  Signers MUST create
signatures using rsa-sha256 and verifiers MUST verify those
signatures.

I disagree with John about the publication of this draft without the
new schemes.  It's worth doing now and the extra overheads of
publication are small.

Nits:

Section 3, two errors here:

> One algorithms, rsa-sha256, is currenlty defined.

Section 3.2 s/,/ / here:

> DKIM,[RFC6376]

Section 6 has an extra period.

Collapse Section 7.1 into Section 7:

"""
IANA is requested to update the "sha1" registration in the "DKIM Hash
Algorithms" as follows:
<table>
"""

On 8 June 2017 at 06:47,  <internet-drafts@ietf.org> wrote:
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the DKIM Crypto Update of the IETF.
>
>         Title           : Cryptographic Algorithm and Key Usage Update to DKIM
>         Author          : Scott Kitterman
>         Filename        : draft-ietf-dcrup-dkim-usage-02.txt
>         Pages           : 6
>         Date            : 2017-06-07
>
> Abstract:
>    The cryptographic algorithm and key size requirements included when
>    DKIM was designed in the last decade are functionally obsolete and in
>    need of immediate revision.  This document updates DKIM requirements
>    to those minimaly suitable for operation with currently specified
>    algorithms.  This document updates RFC 6376.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-dcrup-dkim-usage/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-dcrup-dkim-usage-02
> https://datatracker.ietf.org/doc/html/draft-ietf-dcrup-dkim-usage-02
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-dcrup-dkim-usage-02
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup