Subject: [Dcrup] One algorithm to rule them all, or maybe two

From: "John R. Levine" <[email-masked]>
Date: 19 Sep 2017 08:52:04 -0700

Here's what I know about the two new algorithms:

Hashed RSA:

(good) avoids the txt record 256 byte issue
(good) trivial to implement, no new library dependencies
(good) key in signature prevents obscure reverse engineered un-revoke
(bad) Jim's patent, unknown what Cisco might do with it
(bad) DKIM headers are bigger, crypto is slower with bigger keys

Ed25519:

(good) avoids the txt record 256 byte issue
(good) faster than RSA
(good) DKIM headers don't grow or grow less with copy of key in signature
(bad) popular libraries do not yet support it
(bad) popular libraries may never support pure version, might need to double hash

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 22 Sep 2017 20:42:49 -0400

I think algorithm diversity is important in the long run (added below).

I think it's clear Ed25519 is going to have wide support, so, if one is 
patient, the popular libraries do not yet support it "bad" isn't a big deal.  
Rsa-sha256 should be good for awhile.

The biggest question is will pure be supported or not.

Scott K

> (good) DKIM headers don't grow or grow less with copy of key in signature
(good) provides algorithm diversity which reduces risk DKIM becomes unusable 
in the future if rsa-256 is broken
> John Levine, [email-masked], Primary Perpetrator of "The Internet for
> Dummies", Please consider the environment before reading this e-mail.
> https://jl.ly
> 
> _______________________________________________
> Dcrup mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dcrup

---

From: Martin Thomson <[email-masked]>
Date: Mon, 25 Sep 2017 16:59:44 +1000

I think that you might want to move the point about diversity to the
other column that says "both".  There are indications suggest that EC
breaks before RSA, but those results aren't unequivocal either (and I
can't pretend to know the details).  I tend to think that having and
exercising both will make it easier to move to the next thing, though
I hope that won't be any time soon.

It might be reasonable to assume that people will put the first
quantum computers to work on more lucrative pursuits than spam, but it
might become an attractive target if it is so ossified around a
particular scheme that deploying a PQ scheme is made impossible.

---

From: "John R. Levine" <[email-masked]>
Date: 25 Sep 2017 15:02:28 -0700

> particular scheme that deploying a PQ scheme is made impossible.

It's not just spam.  In the recent US political campaign, some of the 
political e-mail messages from a phished account were authenticated by 
observing that their DKIM signatures were still valid.  The value of a 
verifiable signatures on a fake "stolen" message could be considerable, 
and we've already seen stuff at Wikileaks which mixes real stolen material 
with disinformation.

This probably says something about key rotation policy, but that's a 
separate issue.

Regards,