Subject: WG Last call: RSA-SHA1

From: Olafur Gudmundsson <[email-masked]>
Date: Fri, 08 Sep 2000 02:53:21 -0400

This is a last call on this document, This document defines a new
Signature algorithm transform  RSA/SHA1 to replace RSA/MD5 (alg 1)
currently defined in RFC2537.

This document contains text similar to what is in RFC2537 but changing
the message digest algorithm. The draft also makes RSA/SHA1 a MANDATORY
to implement.

This is a WG last call ending September 20'th 2000

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-rsa-01.txt

The URL for RFC2537 is
http://www.ietf.org/rfc/rfc2537.txt

This draft will replace RFC2537 on standards track, and obsoletes RFC2537.
If you disagree with above action please state why, this document is
not ready or if this should not be done.

Olafur

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Sat, 9 Sep 2000 04:33:50 -0700 (PDT)

> This is a WG last call ending September 20'th 2000

This document does not specify the method for deriving the footprint (id,
tag, whatever it's called now) for an RSA-SHA1 key.  This leads to a
slight ambiguity.  Although RFC2535 specifies the computation method for
all future algorithms, an RSA-SHA1 key is identical to an RSA-MD5 key, and
if the RFC2535 method is used, two identical keys would have different
footprints.

Using the RFC2535 method is probably the right thing to do, but maybe
mentioning this anomaly in the draft would be reasonable.

Brian

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Sat, 09 Sep 2000 22:52:43 -0400

Hi Brian,

That's a good point.  I think the general method given in RFC2535
should be used, which I think is the current implication.  But,
because the previous RSA key used a special method, this change in RSA
KEY tag calculation should be pointed out in the draft.

Thanks,
Donald

From:  Brian Wellington <[email-masked]>
Date:  Sat, 9 Sep 2000 04:33:50 -0700 (PDT)
To:  Olafur Gudmundsson <[email-masked]>
Cc:  DNSEXT WG Mailing list <[email-masked]>
In-Reply-To:  <4.3.2.7.2.20000908023743.00bade00@localhost>
Message-ID:  <[email-masked]>
Content-Type:  TEXT/PLAIN; charset=US-ASCII
Sender:  [email-masked]
Precedence:  bulk

---

From: John Gilmore <[email-masked]>
Date: Mon, 11 Sep 2000 18:27:00 -0700

> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-rsa-01.txt

There is no document at this URL.  (There is a -00 version though.)
Please repost the last-call once a proposed document exists.

> not ready or if this should not be done.

I disagree with the above action.  I believe that RFC 2537 should not
be obsoleted.  It is a valid algorithm identifier, already in use in
widely deployed code, and should remain part of the standard.

RFC 2537 is currrently merely "recommended", not required.

The text in the -00 document is unclear about whether to use algorithm
#1 or #5 in KEY records.  It should state that either is appropriate,
since the selection of hash algorithm for signing does not affect the
key.  It should also note (as pointed out by Brian Wellington) that
the algorithm number used will change the calculation of the 'key tag'
field in any SIG records created using this key, since algorithm #1
used an early method, while all other algorithms use a checksum.

> The draft also makes RSA/SHA1 a MANDATORY to implement.

I'm confused -- has consensus flipped again in the RSA/DSA debate?
Do we now agree that RSA should be mandatory?  Do the IESG and IAB
also agree?  They were the ones who shat on the idea originally.

If RSA is really going to be mandatory, then I think algorithm 1 as
well as 5 should be mandatory, for interoperability.

	John

---

From: Edward Lewis <[email-masked]>
Date: Tue, 12 Sep 2000 10:14:34 -0400

>Please repost the last-call once a proposed document exists.

I see a document at that location...

>well as 5 should be mandatory, for interoperability.

The thinking is that RSA patent will expire RSN, and since MD5 is shakey,
only SHA-1 will be promoted to "mandatory to implement."

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Tue, 12 Sep 2000 11:04:06 -0400

Hi John,

From:  John Gilmore <[email-masked]>
Message-Id:  <[email-masked]>
To:  Olafur Gudmundsson <[email-masked]>
cc:  DNSEXT WG Mailing list <[email-masked]>, [email-masked]
In-reply-to:  <4.3.2.7.2.20000908023743.00bade00@localhost> 
Date:  Mon, 11 Sep 2000 18:27:00 -0700

>Please repost the last-call once a proposed document exists.

My apologies for not cc'ing the list when I sent this in to I-D.  It's
there now.  I suggest the last call ending just be extended by a few
days.

>RFC 2537 is currrently merely "recommended", not required.

I gather from this that you think that RSA-MD5 signatures are strong
and will reamin so for some time despite the weaknesses that have been
identified in MD5?  Declaring RSA-MD5 signatures obsolete does not
make any deployed code stop working, it just tells everyone that they
should move will all deliberate speed to upgrade to RSA-SHA1.

>used an early method, while all other algorithms use a checksum.

The intend is to mandate algorithm #5 for RSA KEYS RRs.  This is
certainly a debatable point and they could have all been left with
algorithm #1 since, as you say, the RSA key is independent of the hash
algorithm.  Or both could be allowed, but that seems more complex.

All of this points up the problem with leaving both algorithms as
approved for use: when/if MD5 is broken, then bad guys can forge
RSA-MD5 signatures based on the RSA KEYs that are in the DNS or are
preconfigured in resolvers even if the keys are there with the intent
that they be used with RSA-SHA1, which is generally acknowledged to be
stronger.  And having two different KEY RR algorithm numbers to
distinguish these is no help, except for pre-configured KEY RRs,
because the bad guys can change the algorithm number.

>also agree?  They were the ones who shat on the idea originally.

Yes, there seems to a ground swell of feeling that RSA should be
mandatory.

>well as 5 should be mandatory, for interoperability.

In my opinon, this guarantees that things will only be as strong as
the weaker of the two algorithms.

Donald