Re: [dispatch] Updating DKIM for stronger crypto

["John R Levine" <[e-mail]>]

> Note that I have no particular axe to grind in favor of
> RSA, but to the extent to which your problem with RSA is merely the size of
> the key in the DNS, then this is the minimal change. In fact, I would argue
> that if you're going to bother to update the specs at all, you should stuff
> the hash in the DNS, not the key.

Given the difficulty of opening up specs, if we're going to do anything 
I'd like to both add the new algorithm and the option to publish key 
hashes.

>> Last year, we learned that DKIM signatures can survive exfiltration and 
>> other subsequent steps leading to publication via wikileaks and that 
>> the same public keys allowing verification were still in use.

This wasn't a surprise to people in the mail ops community.  Most signers, 
even big ones, never rotate their keys, so if you can find an old message, 
you can probably validate it.  Even for people like me who do rotate, 
large passive DNS databases probably have the old keys.  Also, it is my 
recollection that the signatures weren't so much ephemeral as that they 
were expected to be checked fairly soon after signing so long-term 
security wasn't part of the model.

If someone wanted to write something about key lifetimes with a way to 
poison keys by publishing them, that would be OK with me but I wouldn't 
want to put it into the DKIM spec.  Currently it offers no advice on key 
rotation beyond noting that it's possible, and no useful advice on key 
sizes.

R's,
John