Re: [dispatch] Updating DKIM for stronger crypto

[Eric Rescorla <[e-mail]>]

On Sun, Feb 5, 2017 at 6:08 PM, John Levine <[e-mail]> wrote:
>
> Needless to say, 512 bits is now way too weak, and 1K is iffy, so it
> would be a good idea to update the advice.


Well, I certainly agree that at some point it would be good to get to larger
than 1024-bit RSA keys, we're fairly far from the point where it's cheap
to factor a 1024-bit RSA key (absent a quantum computer, in which case
we've got bigger problems), and given that the impact of a complete break
here is you get to forge mail, I'm not sure how urgent this is.


The obvious change would be a one sentence update to the DMARC spec
> saying to sign with at least 2K keys and verifiers must handle at
> least 4K keys.  The code changes to DKIM signers and verifiers would
> be trivial, and it is my impression that most verifiers handle larger
> keys now, since they just pass them to OpenSSL or the like.
>
> Unfortunately, we have a stupid but significant problem.  DKIM keys
> are published in DNS TXT records, the strings in TXT records are
> limited to 256 characters, and keys longer than 1K bits don't fit
> in 256 characters.  No problem you might think, since the DKIM spec
> says that verifiers catenate multiple strings together, so you just
> break the key into two or three strings.
>
> A lot of people manage their DNS using web based crudware at their
> registrar or DNS provider, and most of the crudware only handles TXT
> records with one string.  You don't have to tell me how broken that
> is, but the cruddy state of DNS provisioning has been a problem for
> many years, and nothing we say is going to fix it in any finite amount
> of time.
>
> I note RFCs 7748 and 8032 which remind us that ed25519 has excellent
> performance with much smaller keys.  So I would like to publish a
> small update to the DKIM spec to add ed25519 as a signature algorithm,
> require that ed25519 signatures use at least 256 bits, and provide
> some advice for migration, e.g., publish both keys in separate TXT
> records and sign with both algorithms for a while.  256-bit keys fit
> in a single TXT string with ease.
>
> Does this seem reasonable?
>

Well, sort of.

It seems like this message suggests that the decision to store the key in
the TXT record is perhaps not the optimal design. If you were storing a
digest (as DANE does) then you could use arbitrary sized RSA keys without
running into the 256-character limit. This would also have the advantage
that if you ever needed to move to some post-quantum algorithm with big
keys (e.g., digest signatures), you would be in a somewhat better position.

With that said, moving to elliptic curve is a good idea and Ed25519 seems
like a reasonable choice. Note that the requirement that "ed25519 signatures
use at least 256 bits" is incoherent. Ed25519 denotes a specific elliptic
curve
of size 255 bits.

-Ekr


>
> R's,
> John
>
>
>
> _______________________________________________
> dispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dispatch
>