Re: [dispatch] Proposed charter for DCRUP v0.3

On Fri, Apr 7, 2017 at 9:36 AM, John R Levine <johnl@taugh.com> wrote:

> One last twiddle, make it clear we can deprecate obsolete signing
> algorithms.  I have in mind SHA-1 and RSA-512.
>
> Assuming people are happy with this, what's the next step?
>
> R's,
> John
>
> -----------
>
> The DKIM Crypto Update (DCRUP) working groupkin is chartered to update
> DKIM to handle more modern cryptographic algorithms and key sizes. DKIM
> (RFC 6376) signatures include a tag that identifies the hash algorithm and
> signing algorithm used in the signature. The only current algorithm is RSA,
> with advice that signing keys should be between 1024 and 2048 bits. While
> 1024 bit signatures are common, longer signatures are not because bugs in
> DNS provisioning software prevent publishing longer keys as DNS TXT
> records.
>
> DCRUP will consider three types of changes to DKIM: additional signing
> algorithms such as those based on elliptic curves, changes to key strength
> advice and requirements including deprecating obsolete algorithms, and new
> public key forms, such as putting the public key in the signature and a
> hash of the key in the DNS.  It will limit itself to existing implemented
> algorithms and key forms.

Can you clarify "implemented" here? Do you just mean "in wide use by IETF
or otherwise"?

-Ekr

Other changes to DKIM, such as new message canonicalization schemes, are
> out of scope.  The WG will as far as possible avoid changes incompatible
> with deployed DKIM signers and verifiers.
>
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch
>