Subject: Re: [ietf-dkim] RFC4871bis - whether to drop -- SHA1 support

From: Jon Callas <[email-masked]>
Date: Mon, 1 Jun 2009 15:52:35 -0700

On May 30, 2009, at 10:17 AM, Dave CROCKER wrote:

> Folks,
>
>
> In:
>
>   <http://mipassoc.org/pipermail/ietf-dkim/2009q2/011959.html>
>
> Steve Atkins posted a list of suggested DKIM features to drop.
>
> This note is intended to anchor a discussion thread for discusses  
> one of those
> features, namely:
>
>
>>    Drop support for SHA1 entirely. It's beginning to look
>> cryptographically very dubious, and is being dropped by pretty much
>> everyone else. Even if the attacks against it don't affect the way
>> it's used in DKIM it seems unwise to suggest it be used at all. At  
>> the
>> very least it seems a poor "marketing" move to include an algorithm
>> that's been dropped by most everyone else as insecure before this  
>> spec
>> is finalized.
>>
>>    "Verifiers MUST support rsa-sha256 and MAY support rsa-sha1.
>> Signers SHOULD sign using rsa-sha256 and SHOULD NOT sign using rsa-
>> sha1." might provide enough wiggle room to allow existing code time  
>> to
>> migrate away from SHA1.

I don't think it's worth expending breath on removing SHA1. Our power  
to compel people to move away from SHA1 is limited. My belief is that  
anyone who is still using SHA1 is suffering from a mild form of  
insanity or is a sane person living in a slightly insane world. Even  
if we remove it from the spec, the implementors will likely have to  
keep it in for the slightly insane people and worlds.

It is far more important for us to put SHA3 into 4871bis, as that will  
be finalized in 2012, and if you *can't* use it in DKIM, people would  
be justifiably miffed for us.

In short, we shouldn't spend effort correcting the past that we can  
better spend improving the future. This is especially true given that  
improvements to the future are our best hope for correcting the past.

	Jon

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Suresh Ramasubramanian <[email-masked]>
Date: Tue, 2 Jun 2009 09:03:15 +0530

> be justifiably miffed for us.

It'd actually be a good idea to delink specific encryption and hash
algorithms from 4871bis - so that people can use as strong an
algorithm as they like .. possibly specify an "at least sha256" with a
note that points to somewhere you can read up on a balance between
strong crypto and usability / scalability in large deployments.

srs

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 2 Jun 2009 12:00:17 -0700

Quoth Jon Callas:
> I don't think it's worth expending breath on removing SHA1. [...]

+1

-MSK