Subject: [Dcrup] Deprecating algorithms

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 13 Jun 2017 06:45:50 -0700

<chair>

As a procedural matter, I looked at our charter and discovered that it
doesn't explicitly allow us to deprecate "rsa-sha1".  It only allows us to
make new algorithms or ways to transport larger keys, and give revised
advice about key sizes.

For the sake of dotting and crossing everything I talked to Alexey and Eric
and they don't imagine there would be a problem here, nor would it be a
problem to adjust the charter accordingly.  I'd prefer to have the charter
tweaked so we're covered, and since doing so wouldn't interrupt our work
flow, unless anyone objects I'm going to ask Alexey to start that process
for us.

</chair>

-MSK

---

From: Martin Thomson <[email-masked]>
Date: Tue, 13 Jun 2017 15:52:22 +0100

This is a fine thing.  Do you want to propose text for the charter?

On 13 June 2017 at 14:45, Murray S. Kucherawy <[email-masked]> wrote:
> _______________________________________________
> Dcrup mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dcrup
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 13 Jun 2017 18:37:59 -0700

> This is a fine thing.  Do you want to propose text for the charter?

The diff to the current charter is going to be mighty small, so sure, I'll
do it this week sometime.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 14 Jun 2017 04:59:34 -0700

> do it this week sometime.

Proposed revised charter text.  A crypto person should review it to make
sure it's not nonsense since I only know enough about crypto to be
dangerous.  Apologies for the silly wrapping; I fought with the gmail
interface to make it pretty and failed.

-- snip --

The DKIM Crypto Update (DCRUP) Working Group is chartered to update
DomainKeys Identified Mail (DKIM, RFC 6376) to handle more modern
cryptographic algorithms and key sizes. DKIM (RFC 6376) signatures
include a tag that identifies the hash algorithm and signing algorithm
used in the signature. The only current algorithm is RSA, with advice
that signing keys should be between 1024 and 2048 bits. While 1024 bit
signatures are common, longer signatures are not because bugs in DNS
provisioning software prevent publishing longer keys as DNS TXT records.

DKIM also currently supports use of SHA1 coupled with RSA.  SHA1 has been
formally deprecated due to weakness especially when used in the context
transport security, though the risk of a successful preimage attack is less
severe.  Still, the community wishes to discourage its continued use in the
DKIM context.

DCRUP will consider four types of changes to DKIM: additional signing
algorithms such as those based on elliptic curves, changes to key
strength advice and requirements, deprecating the use of SHA1, and new
public key forms, such as
putting the public key in the signature and a hash of the key in the
DNS to bypass bugs in DNS provisioning software that prevent publishing
longer keys as DNS TXT records. It will limit itself to existing
implemented algorithms and key forms. Other changes to DKIM, such as new
message canonicalization schemes, are out of scope. The WG will as far
as possible avoid changes incompatible with deployed DKIM signers and
verifiers.

---

From: Kurt Andersen <[email-masked]>
Date: Thu, 15 Jun 2017 12:59:02 +0100

On Wed, Jun 14, 2017 at 12:59 PM, Murray S. Kucherawy <[email-masked]>
wrote:

>> On Tue, Jun 13, 2017 at 7:52 AM, Martin Thomson <[email-masked]
>> > wrote:
>>
>> The diff to the current charter is going to be mighty small, so sure,
>> I'll do it this week sometime.
>>
>
> Proposed revised charter text.  . . .
>
I don't think that we need this editorializing paragraph. What you have
below should be sufficient (delta changes highlighted):

> DCRUP will consider
- three
+ four

> types of changes to DKIM: additional signing
>
> strength advice and requirements,
>
 +deprecating the use of SHA1,

> and new public key forms, such as. . .
>
--Kurt