Subject: [ietf-dkim] A question about public key formats

From: Steve Atkins <[email-masked]>
Date: Fri, 22 May 2009 23:24:47 -0700

The OpenSSL library gives you access to the public key of an RSA pair  
in several formats (PKCS#1, X509 and I think XML <RSAKeyValue>) and  
the perl wrapper, Crypt::OpenSSL::RSA provides access to two of those  
via functions:

get_public_key_string: Return the Base64/DER-encoded PKCS1  
representation of the public key.

get_public_key_x509_string: Return the Base64/DER-encoded  
representation of the "subject public key", suitable for use in X509  
certificates.

It's not entirely clear to me from RFC4871 which of those is the  
correct one to use - as it just points at RFC3447, which is not the  
clearest of documents, and doesn't seem to say anything relevant. If I  
had to guess, I'd say the former, as that's the form that's described  
as a PKCS#1 format.

The implementations I've seen, and the ("INFORMATIVE") examples in  
RFC4871 seem to use the latter.

I don't see how the normative section of 4871 suggests that the X509  
format is the right one to use. Can anyone point me at the line of  
reasoning there?

Cheers,
   Steve

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 25 May 2009 12:05:23 -0000

>representation of the public key. (the DER form)

>certificates. (the PEM form)

>correct one to use

Looking at some of the DKIM libraries, it appears that the openssl
code will accept either one, so this is underspecified.  I agree that
PEM is what people typically use.

R's,
John

---

From: John Levine <[email-masked]>
Date: 25 May 2009 14:01:26 -0000

>certificates. (the PEM form)

I did an experiment.  I use the openssl command to make my keys.
Normally it makes PEM public keys which it emits in base64 encoded
form, but I told it to make in in DER form.  It produces DER keys in
binary, so I base64 encoded it and put it in the DNS.  As I expected,
the Mail::DKIM perl package verifies those signatures correctly.

This message's signature has a DER verification key so see what your
verifier thinks.

Even though either form works, it's probably worth a defect report to
say that PEM format is the one to use just in case someone uses a
library that cares about the difference.

R's,
John