IETF Logo Mail Archive

Re: [Ietf-dkim] DKIM key rotation best practice

Alessandro Vesely <vesely@tana.it> Fri, 07 August 2020 09:11 UTC

Return-Path: <vesely@tana.it>
X-Original-To: ietf-dkim@ietfa.amsl.com
Delivered-To: ietf-dkim@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAB283A0CEA for <ietf-dkim@ietfa.amsl.com>; Fri, 7 Aug 2020 02:11:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.047
X-Spam-Level:
X-Spam-Status: No, score=-3.047 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.949, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1152-bit key) header.d=tana.it
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h3xRmQEhcWHg for <ietf-dkim@ietfa.amsl.com>; Fri, 7 Aug 2020 02:11:13 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AB6D3A0DCF for <ietf-dkim@ietf.org>; Fri, 7 Aug 2020 02:11:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=delta; t=1596791471; bh=ENoondy/5LZoNmTZKfim79WB8Qkhnu3EonoDRHftXgg=; l=684; h=To:References:From:Date:In-Reply-To; b=BP4UTa0xGfU6FODFbaePfJuhEClwVY51LRTJ+OkKCQa8R/gA2uowCiEiOfFrg42/X Qc/Qm4zjQFPJQRFTd/p9Qkskoj9LwveqkMMobyUL2H+FM6G3wS2Sybgqjo4vVniW8p XQCEvhEDH/1/0AHSwT62fNLasfxQINf9hFCEPT8l1ntY5TLAEaDND2Cyej6ZJ
Authentication-Results: tana.it; auth=pass (details omitted)
Received: from [192.168.1.102] ([5.170.69.167]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLS1.3, 128bits, ECDHE_RSA_AES_128_GCM_SHA256) by wmail.tana.it with ESMTPSA id 00000000005DC0DD.000000005F2D1AAE.00007F80; Fri, 07 Aug 2020 11:11:10 +0200
To: ietf-dkim@ietf.org
References: <BYAPR15MB25670F15F55200ED4145124AEC480@BYAPR15MB2567.namprd15.prod.outlook.com> <59c0fd6f-1406-9981-a78f-1c08d774c76a@dcrocker.net> <20200807035323.13761.qmail@f3-external.bushwire.net>
From: Alessandro Vesely <vesely@tana.it>
Message-ID: <03a35673-a92c-6677-8e29-cb5c57c49320@tana.it>
Date: Fri, 07 Aug 2020 11:11:10 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20200807035323.13761.qmail@f3-external.bushwire.net>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-dkim/BkicV7hD3YSUsiTiNOlMMjeJUvo>
Subject: Re: [Ietf-dkim] DKIM key rotation best practice
X-BeenThere: ietf-dkim@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DKIM List <ietf-dkim.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-dkim>, <mailto:ietf-dkim-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf-dkim/>
List-Post: <mailto:ietf-dkim@ietf.org>
List-Help: <mailto:ietf-dkim-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-dkim>, <mailto:ietf-dkim-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Aug 2020 09:11:15 -0000


On 2020-08-07 5:53 a.m., Mark Delany wrote:
> On 06Aug20, Dave Crocker allegedly wrote:
>> M3AAWG DKIM Key Rotation Best Common Practices
>> (revised March 2019)
>>
>> https://www.m3aawg.org/DKIMKeyRotation
> 
> Luckily the tl;dr is in the first line. Phew! Quite the read :-)


Section 5.1.3 "Rotating Keys" is also worth reading, as it discusses
setting an empty p=.


> It seems that both Maawg and letsencrypt are both pro-automation. I
> think that's the biggest take-away for the OP.


That paper doesn't mention publishing the private key some time after
public key revocation.  Someone suggested to do so to avoid the
Clinton effect.


Best
Ale
--

v2.23.0 | Report a Bug | By Email