[saag] Re: Updating dkim standard to forbid rsa 1024 after deepmind paper on rsa ?

[John Levine <[e-mail]>]

>>Im wondering if dkim standard should have a bis or a deprecation for 
>>rsa 1024 ?

tl;dr  No.

The DKIM WG is developing a follow-on to DKIM, currently called DKIM2.  It uses
the same keys as DKIM and its predecessort Domain Keys.  In DKIM2, the currently
optional Ed25519 signature is made mandatory and we'll add a PQC scheme.  Nobody
is working on the existing DKIM spec which we expect to be obsolete in a few years.

We are not the Network Police and telling DKIM users to stop using 1K keys will
have zero efffect. (They don't use Ed25519 keys either, not even me and I wrote
the RFC.) Mail operators who are paying attention are aware that 1K keys are too
weak and have moved to 2K. Mail operators who are not paying attention will
continue not to pay attention.

Before someone says stop accepting 1K signatures, nope. They're signing real
mail, and the definite loss of valid mail with weak keys far outweighs the
hypothetical threat that someone might forge a few short lived DKIM keys.

R's,
John