Hi all,
Bron brought to my attention that there is an errata described posted to
the DKIM2 github repository "Clarify DKIM2 RSA p= encoding: SPKI reflector
keys fail a strict verifier
#9": https://github.com/dkim2wg/interop/issues/9. The errata says that
RFC6376 and draft-ietf-dkim-dkim2-dns-00 says to parse RSA as RSAPublicKey,
however Appendix C of RFC6376 openssl instruction generates
SubjectPublicKeyInfo. RSAPublicKey is defined RFC8017 as:
RSAPublicKey ::= SEQUENCE {
modulus INTEGER, -- n
publicExponent INTEGER -- e
}
SubjectPublicKeyInfo is defined by RFC5280 (PKIX) as:
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING
}
SubjectPublicKey with RSA key content is then defined to be RSAPublicKey in
RFC4055. The errata notes that the DKIM2 reflector uses SubjectPublicKey
following the practice in Appendix C as well many other DKIM examples found
on the internet. I've replicated the issue described by the "Live
reflector evidence" in the report and concur with the observation from
RFC6376 that both RSAPublicKey and SubjectPublicKeyInfo RSA formats are
specified. Bron also notes that there are three other errata on RFC6376:
3017, 6674 and 7001 (https://errata.rfc-editor.org/eid3017/,
https://errata.rfc-editor.org/eid6674/,
https://errata.rfc-editor.org/eid7001/). Errata #9, 3017 and 7001 says to
use SubjectPublicKeyInfo. 6674 and 7001 fixes the example. Bron and 3017
suggests that both formats should be supported for interoperability, which
I agree with. Does the community agree that both formats be supported?
Assuming that both formats RSAPublicKey or
SubjectPublicKeyInfo-RSAPublicKey should be supported, I propose the
following language be introduced to fix this in section 3.4.1 of
draft-ietf-dkim-dkim2-dns (
https://www.ietf.org/archive/id/draft-ietf-dkim-dkim2-dns-00.html#section-3.4.1
):
k= Key type (plain-text; OPTIONAL, default is "rsa"). Signers and
Verifiers MUST support the "rsa" key type. The "rsa" key type
indicates that an ASN.1 DER-encoded [ITU-X660-1997] RSAPublicKey
(see [RFC8017], Sections 3.1 and A.1.1) or
SubjectPublicKeyInfo-RSAPublicKey
(see [RFC5280] and [RFC4055]) is being used in the "p="
tag. (Note: the "p=" tag further encodes the value using the
base64 algorithm.) In addition Signers and Verifiers SHOULD
support the "ed25519" key type (See [RFC8463]). The p= value in
the key record is the Ed25519 public key encoded in base64.
Unrecognized key types MUST be ignored.
I propose that there should be a new appendix section to discuss the errata
and describe a method to check for RSAPublicKey vs
SubjectPublicKeyInfo-RSAPublicKey. Presumably DKIM1 and DKIM2 verifiers
should check for AlgorithmIdentifier rsaEncryption prefix before proceeding
to parse RSAPublicKey or SubjectPublicKeyInfo. Should the errata update
only occur in draft-ietf-dkim-dkim2-dns, or should RFC6376 also be updated?
-Wei
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
