Subject: [Dcrup] SHA1 in current software

From: "A. Schulze" <[email-masked]>
Date: Fri, 16 Mar 2018 15:27:05 +0100

Hello,

I just stumbled about a message from Ebay I just received. SHA1 signed :-/
Yes, SHA1 is deprecated. But the software I usual use still mark such messages as valid.

I think it's time for a software update. But how to handle SHA1 technically?
The way of "minimum surprise to the admin" would be to introduce new option "rfc8301-conformance = yes | no"
Ideas about the default?

Anyway a signature validation result "PERMFAIL" would not immediately reject such messages.
But it would be visible via DMARC aggregate reporting to the sender.

Please advise if this is not the right place for discussion on
specific implementation.

Andreas

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 16 Mar 2018 12:54:51 -0400

On Friday, March 16, 2018 03:27:05 PM A. Schulze wrote:
> The way of "minimum surprise to the admin" would be to introduce new option
> "rfc8301-conformance = yes | no" Ideas about the default?
> 
> Anyway a signature validation result "PERMFAIL" would not immediately reject
> such messages. But it would be visible via DMARC aggregate reporting to the
> sender.
> 

I think exposing this in DMARC reporting is a great idea.  I suspect the DMARC 
list ([email-masked]) is likely a better place to discuss how to go about it.  
At this point, making the issue visible to senders is the right place to 
focus.

This also connects to the RFC 7601bis work that is (IIRC) also discussed on 
that list since I've asked to have the DKIM key type and hash algorithm added 
to authentication results.

Scott K