It appears that Richard Clayton <[email protected]> said: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >>Internet-Draft draft-ietf-dkim-dkim2-spec-09.txt is now available. It is a >>work item of the Domain Keys Identified Mail (DKIM) WG of the IETF.
Section 3 says about SHA256 and SHA512: Signers MAY implement either or both of the two hashing algorithms and any or all of the signing algorithms. Verifiers MUST implement all five algorithms. But now there are only three signing algoriths, RSA-SHA256, Ed25519-SHA256 and ML-DSA-44, of which two use SHA256, one doesn't, and neither uses SHA512. I'd change the spec to say signers MUST implement SHA256 and SHOULD implement SHA512. Verifiers MUST implement both of them because even though there's no SHA512 signatures, you're allowed to use SHA512 to hash Message-Instance and per a note later on, the point is to be able to test hash algorithm migration. In 9.3 Message-Instance lets you do multiple hashes with AND or OR logic with hash-any or hash-all. That doesn't make much sense. PQCs are irrelevant to hash functions because hashes are not reversible. The reason we abandoned SHA1 is that someone found a conventional collision attack. SHA256 and SHA512 are basically the same algorithm with different parameters, so it seems likely that if one is broken, both are. I would get rid of the hash-any option and keep hash-all, so the verifier has to check every hash it understands and pass if all the ones it checked are good. There's no point to doing both SHA256 and SHA512 other than for testing, but if they're broken I can see using SHA256 and whatever replaces it for a while until we think the new hash is widely enough adopted to stop using SHA256 and SHA512. R's, John _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
