Subject: [dmarc-ietf] ARC Crypto Algorithm Selection

From: Scott Kitterman <[email-masked]>
Date: Tue, 23 Oct 2018 06:58:33 -0400

I've started looking at updating dkimpy to align to the current versions of 
the specification.

Last time I looked at this particular issue, ARC could use any algorithm that 
DKIM uses.  As I recall, that was once of the stimuli for the DCRUP working 
group (to avoid having rsa-sha1 be valid for ARC by obsoleting it in DKIM).

It looks like this discussion has been moved to a new draft, 
https://tools.ietf.org/html/draft-ietf-dmarc-arc-multi-01 (although the 
reference is wrong, https://tools.ietf.org/html/draft-ietf-dmarc-arc-multi-02 
is current.

Unfortunately, I don't find any actual guidance on what algorithms are 
currently used.  Secion 6, Phases of Algorithm Evolution, gives some process 
(which seriously needs revision - I thought we all knew flag days don't work 
at Internet scale), but no actual guidance.

DKIM, as updated by the DCRUP work, has two valid crypto algorithms:

rsa-sha256
ed25119-sha256

One has been obsoleted:

rsa-sha1

Which among those is valid for ARC and how do I know?

Scott K

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Tue, 23 Oct 2018 08:24:13 -0700

On Tue, Oct 23, 2018 at 3:58 AM Scott Kitterman <[email-masked]>
wrote:

> DKIM uses.

Still correct.

>   As I recall, that was once of the stimuli for the DCRUP working

I don't think that ARC drove the DCRUP work as much as the desire to get
badness officially obsoleted :-)

> reference is wrong,
> https://tools.ietf.org/html/draft-ietf-dmarc-arc-multi-02
> is current.
>

Yes that's correct.

> currently used.

Any that are valid for DKIM - see first sentence above.

> Secion 6, Phases of Algorithm Evolution, gives some process

Correct - we've deferred any real attention on this until we got the ARC
protocol document nailed down. With the request to publish being a few
hours old now from Barry, this might be an excellent topic to pursue next
:-)

> Which among those is valid for ARC and how do I know?

The same ones that are valid for DKIM (as updated by DCRUP). What we
haven't worked out is how to handle mixed algorithm chains.

--Kurt

---

From: Seth Blank <[email-masked]>
Date: Tue, 23 Oct 2018 08:25:03 -0700

ARC inherits all the DKIM mechanisms by reference. So whatever’s valid for
DKIM (the list you provided) is what’s valid for ARC.
On Tue, Oct 23, 2018 at 03:58 Scott Kitterman <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Hector Santos <[email-masked]>
Date: Tue, 23 Oct 2018 12:23:42 -0400

In my view, ARC, as an "Experimental Status" (and still in design) 
proposal *should* include support for all valid DKIM STD hashing 
methods, including rsa-hash1, and I agree, should not be the impetus 
for removing sha1 support in DKIM implementations.

Until a DKIM implementation is "ready" to a) consider DCRUP and b) add 
support for ed25119-sha256 (which comes with a considerable technical 
barrier), rsa-sha1 is still going to be available and used by pure 
DKIM STD implementations for the foreseeable future (a long time).  I 
haven't been seeing many messages in my logs showing rsa-ed25119 DKIM 
signings, in today's logs so far, not one.

-- 
HLS

On 10/23/2018 11:24 AM, Kurt Andersen (b) wrote:
> On Tue, Oct 23, 2018 at 3:58 AM Scott Kitterman <[email-masked]
> <mailto:[email-masked]>> wrote:
>
> I don't think that ARC drove the DCRUP work as much as the desire to
> get badness officially obsoleted :-)
>
> Correct - we've deferred any real attention on this until we got the
> ARC protocol document nailed down. With the request to publish being a
> few hours old now from Barry, this might be an excellent topic to
> pursue next :-)
>

---

From: "John Levine" <[email-masked]>
Date: 24 Oct 2018 15:59:46 -0000

In article <[email-masked]>,

>> DKIM, as updated by the DCRUP work, has two valid crypto algorithms:

I would defer working on this until we clarify how algorithm switching will work.

One place that ARC differs from DKIM is that many DKIM signatures are OK but
you can only have one ARC seal per forward.  In draft-ietf-dmarc-arc-multi-02
we say how I think it can work, but it's not quite backward compatible.

R's,
John
-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly