Subject: [secdir] Secdir review of draft-ietf-dcrup-dkim-usage-04

From: Magnus Nyström <[email-masked]>
Date: Mon, 11 Sep 2017 23:33:53 -0700

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

This document intends to update the DKIM specification with a new mandatory
hash algorithm (SHA-256) and new RSA key size requirements.

While I definitely agree with the stated direction, I do wonder about the
RSA 1024 bit key size recommendation. Conventionally, this corresponds to
about 80-bit security and to reach the equivalent of 128-bit security
(which is what SHA-256 gives), a 3072-bit RSA key size should be
recommended. In this day and age, mandating only 1024 bits seems a little
weak. I recognize there may be limitations in the DNS records storing these
keys, but it should be possible to store at  least 2048-bit keys (256 bits)
(corresponding roughly to 112-bit security) or at least close to it and
thus why not require 2048 bit RSA keys as a minimum? 1024 bit keys are, as
is also commonly known, considered "legacy" by NIST SP 800-57 part 1 and
shouldn't be used for new signatures at this point.

-- Magnus

---

From: Russ Housley <[email-masked]>
Date: Tue, 12 Sep 2017 23:11:22 -0400

Magnus:

I agree with your recommendation, but I would like to make sure I understand your suggestion.  The document says:

   ...  Since short RSA keys more easily succumb to
   off-line attacks, Signers MUST use RSA keys of at least 1024 bits for
   all keys.  Signers SHOULD use RSA keys of at least 2048 bits. ...

You want to change "1024" to "2048", and then drop the following sentence, right?

Russ

> On Sep 12, 2017, at 2:33 AM, Magnus Nyström <[email-masked] <mailto:[email-masked]>> wrote:
> 
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. 
> 
> This document intends to update the DKIM specification with a new mandatory hash algorithm (SHA-256) and new RSA key size requirements.
> 
> While I definitely agree with the stated direction, I do wonder about the RSA 1024 bit key size recommendation. Conventionally, this corresponds to about 80-bit security and to reach the equivalent of 128-bit security (which is what SHA-256 gives), a 3072-bit RSA key size should be recommended. In this day and age, mandating only 1024 bits seems a little weak. I recognize there may be limitations in the DNS records storing these keys, but it should be possible to store at  least 2048-bit keys (256 bits) (corresponding roughly to 112-bit security) or at least close to it and thus why not require 2048 bit RSA keys as a minimum? 1024 bit keys are, as is also commonly known, considered "legacy" by NIST SP 800-57 part 1 and shouldn't be used for new signatures at this point.
> 
> -- Magnus

---

From: Magnus Nyström <[email-masked]>
Date: Tue, 12 Sep 2017 20:43:05 -0700

Yes, Russ. Perhaps "When using RSA, signers MUST use keys at least 2048
bits long." (I could imagine that at some point DKIM would support ECC)
Thanks,

On Tue, Sep 12, 2017 at 8:11 PM, Russ Housley <[email-masked]> wrote:

> Magnus:
>
> I agree with your recommendation, but I would like to make sure I
> understand your suggestion.  The document says:
>
> On Sep 12, 2017, at 2:33 AM, Magnus Nyström <[email-masked]> wrote:
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> This document intends to update the DKIM specification with a new
> mandatory hash algorithm (SHA-256) and new RSA key size requirements.
>

-- 
-- Magnus

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 13 Sep 2017 00:23 -0400

We did consider a larger minimum in the working group.  The conclusion we 
reached was that, given the other text that is in a key record the longest key 
that would reliably fit in a single DNS TXT string is 1156 bits.

There are a surprisingly large number of DNS providers that do not allow 
multi-string DNS TXT records, so any requirement for larger that 1156 bits 
would create a large, new barrier to deployment.

The WG perspective was that the added security changing from 1024 bits (which 
is very commonly used today) to 1156 bits was not worth the friction it would 
cause.

There is another document coming that will add Ed25519 to DKIM.  Ed25519 keys 
do not have the same length issues that RSA keys do. The long-term path for 
DKIM to improve security in the face of the common shortfalls of DNS 
provisioning systems is Ed25519, but that will take time to deploy.

Is there enough value in 1156 bits over 1024 bits that we should change it to 
an unusual key size?

Scott K

P.S.  I am not subscribed to the secdir list, so please keep me in cc on 
replies.

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 13 Sep 2017 13:05:12 +0000

Because of limitations in the DNS system, RSA 1K is really all that’s practical.  For stronger security we are moving to ECC, which is covered in a separate I-D.  This document is really about getting rid of RSA-512.

From: Magnus Nyström <[email-masked]>
Date: Tuesday, September 12, 2017 at 11:43 PM
To: Russ Housley <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [secdir] Secdir review of draft-ietf-dcrup-dkim-usage-04

Yes, Russ. Perhaps "When using RSA, signers MUST use keys at least 2048 bits long." (I could imagine that at some point DKIM would support ECC)
Thanks,

On Tue, Sep 12, 2017 at 8:11 PM, Russ Housley <[email-masked]<mailto:[email-masked]>> wrote:
Magnus:

Russ

On Sep 12, 2017, at 2:33 AM, Magnus Nyström <[email-masked]<mailto:[email-masked]>> wrote:

-- Magnus

--
-- Magnus