Re: [Dcrup] Review of draft-ietf-dcrup-dkim-crypto-03

[Eric Rescorla <[e-mail]>]

On Sun, Jul 9, 2017 at 5:01 PM, John Levine <[e-mail]> wrote:

> In article <CABcZeBMaZ-q5kVTLF2qK+tqtgf2qAyZFsydZrXzYTLuwC2Ecag@
> mail.gmail.com> you write:
> >What I'm trying to do is reduce the additional complexity of adding new
> >algorithms in the future by having a consistent approach going forward.
>
> Given that we will always have code for both hashed and unhashed keys,
> since unhashed RSA isn't going away, my minimal complexity approach is
> to add an algorithm with unhashed keys if the keys are small, and with
> hashed keys if the keys are large.
>
> Since DKIM has no opportunity for algorithm negotiation, verifiers
> have to implement every algorithm that signers might use, so the
> main goal is to minimize the number of algorithms, regardless of
> what they are.
>
> At this point I'm inclined to take out hashed RSA, since the problem
> it solves only exists due to stupid configuration software, and anyone
> who implements hashed RSA would also implent EdDSA which doesn't
> have the configuration key size problem.
>

Moreover, not having hashed RSA basically commits to EC-only and
I know there are people who would like to keep RSA viable. Moreover,
as I think I've mentioned before, this is a charter item and it was a basic
assumption when the WG was formed.


 As I read RFC 8032, the chances are pretty good that ed25519 will last
> as long as DKIM does, so we won't have to do this again.
>

Again, absent Quantum Computers.

Anyway, I think we're past the point where mailing list discussion is
helpful,
so I suggest we simply pick it up in Prague.

-Ekr

R's,
> John
>