Re: [Dcrup] draft-ietf-dcrup-dkim-usage and document shepherds

[Kurt Andersen <[e-mail]>]

On Tue, Jun 13, 2017 at 8:49 AM, Seth Blank <[e-mail]> wrote:

> On Mon, Jun 12, 2017 at 3:29 PM, Scott Kitterman <[e-mail]>
> wrote:
>
>> If I knew which of the three approaches to take, then I could  pick one
>> and
>> write it:
>>
>> 1.  Fully replace section 3.3 explicitly saying MUST rsa-sha256 and MUST
>> NOT
>> rsa-sha1 (my personal preference)
>>
>> 2.  Fully replace section 3.3 dropping rsa-sha1 and just giving the new
>> requirements (possibly with an appendix that says MUST NOT rsa-sha1)
>>
>> 3.  Make the draft a lot shorter and only state updated requirements.
>> Also
>> don't remove rsa-sha1 [1]
>>
>
> I think #2 is the cleanest for a lot of reasons, but I'm sympathetic to
> the argument about the RFC making it clear what has changed to an
> implementer reading it and this has persuaded me, If the point of this
> document is to get implementers who have been using sha-1 and weak keys to
> throw them out - #1's language accomplishes this explicitly.
>
> So I'm voting for #1.
>

I'd much prefer approach #2, but rather than "replace in place", the
replacement should point to a registry with the details in the registry
subject to expert review for future updates. The initial population of
registry entries should designate sha1 and rsa keys <1024bits as either
"not supported" or "deprecated" or whatever other terminology conveys the
same message in registry-speak.

--Kurt