Subject: Re: Last Call: <draft-ietf-dcrup-dkim-crypto-09.txt> (A new cryptographic signature method for DKIM) to Proposed Standard

From: Russ Housley <[email-masked]>
Date: Wed, 30 May 2018 16:26:13 -0400

I have three comments on draft-ietf-dcrup-dkim-crypto-09.

In section 3, this document says that it uses "PureEDdSA"; however, RFC 8032 provide a definition for PureEdDSA.  I assume this is a simple typo.

How hard would it be to expand section 6 to include an example of two selectors being used, one with RSA and one with ed25519?  If it is pretty easy, I think it would help the reader.

RFC 6376 have an extensive security considerations section.  This document should point out that the private key protection discussed in Section 8.3 of RFC 6376 applies to the ed25519 private key.  In addition, I think there should be a section similar to Section 8.13 of RFC 6376 in this document; it might just be a pointer to Section 8 of RFC 8032.

Russ

> On May 29, 2018, at 9:04 AM, The IESG <[email-masked]> wrote:
> 
> 
> The IESG has received a request from the DKIM Crypto Update WG (dcrup) to
> consider the following document: - 'A new cryptographic signature method for
> DKIM'
>  <draft-ietf-dcrup-dkim-crypto-09.txt> as Proposed Standard
> 
> The IESG plans to make a decision in the next few weeks, and solicits final
> comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2018-06-12. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the beginning of
> the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>   This document adds a new signing algorithm to DKIM.
> 
> 
> 
> 
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-dcrup-dkim-crypto/
> 
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-ietf-dcrup-dkim-crypto/ballot/
> 
> The following IPR Declarations may be related to this I-D:
> 
>   https://datatracker.ietf.org/ipr/3025/
> 
> 
> 
> 
>

---

From: "John Levine" <[email-masked]>
Date: 30 May 2018 16:59:14 -0400

>assume this is a simple typo.

yEs

>How hard would it be to expand section 6 to include an example of two selectors being used, one with RSA and one with
>ed25519?  If it is pretty easy, I think it would help the reader.

I can ask the guy who produced the example.  It shouldn't be very hard.

>RFC 6376 have an extensive security considerations section.  This document should point out that the private key
>protection discussed in Section 8.3 of RFC 6376 applies to the ed25519 private key.  In addition, I think there should
>be a section similar to Section 8.13 of RFC 6376 in this document; it might just be a pointer to Section 8 of RFC 8032.

I don't disagree with any of the points but it all seems so obvious
other than perhaps the pointer to the 8032 security section.  I'm
trying to envision the person who has sufficient skill to add EC keys
to his DKIM setup but has to be reminded that it would still be a bad
idea to publish the public keys.

Perhaps I can add a sentence saying that all of the security advice in
6376 applies except that the advice in 8032 supercedes the
RSA-specific advice.

R's,
John

---

From: Russ Housley <[email-masked]>
Date: Wed, 30 May 2018 17:28:49 -0400

> On May 30, 2018, at 4:59 PM, John Levine <[email-masked]> wrote:
> 

As assumed....

> I can ask the guy who produced the example.  It shouldn't be very hard.

Cool.

> 6376 applies except that the advice in 8032 supercedes the

Actually, that would be sufficient.

Russ