ietf-corpus

rfc-8301

Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM)

S. Kitterman
date2018-01 streamIETF areaart wgdcrup statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc8301 doi10.17487/RFC8301
The cryptographic algorithm and key size requirements included when DomainKeys Identified Mail (DKIM) was designed a decade ago are functionally obsolete and in need of immediate revision. This document updates DKIM requirements to those minimally suitable for operation with currently specified algorithms.

updates

Extracted elements (10)

design-rationale §1

SHA-1 is prohibited proactively to allow the operational community time to fully shift to SHA-256 in advance of any SHA-1-related crisis, given its recognized weakness and the wide availability of SHA-256.

email, crypto, security

design-rationale §1

Widely used DNS configuration software places a practical limit on key sizes because it only handles a single 256-octet string in a TXT record, making RSA keys significantly longer than 1024 bits impractical in many deployments.

email, dns, crypto

interoperability-note §3.1

DKIM signatures identified as having been signed with historic algorithms (rsa-sha1) or with insufficient key sizes (rsa-sha256 with less than 1024 bits) have permanently failed evaluation per Section 3.9 of RFC 6376.

email, crypto

normative-requirement §3.1 MUST NOT

Signers MUST sign using rsa-sha256. Verifiers MUST be able to verify using rsa-sha256. rsa-sha1 MUST NOT be used for signing or verifying.

email, crypto, security

normative-requirement §3.2 MUST

Signers MUST use RSA keys of at least 1024 bits for all keys. Signers SHOULD use RSA keys of at least 2048 bits.

email, crypto, security

normative-requirement §3.2 MUST

Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096 bits, and they MAY be able to validate signatures with larger keys.

email, crypto, security

normative-requirement §3.2 MUST NOT

Verifiers MUST NOT consider signatures using RSA keys of less than 1024 bits as valid signatures.

email, crypto, security

protocol-element §3.1

DKIM supports two signing algorithms: rsa-sha1 and rsa-sha256. rsa-sha1 is now historic and permanently fails evaluation; rsa-sha256 is the required algorithm.

email, crypto

registry §5

IANA updated the 'sha1' registration in the 'DKIM Hash Algorithms' registry, changing its status to 'historic' and adding RFC 8301 as a reference.

email, registry

security-consideration §4

This document reduces the risk of signature compromise due to weak cryptography. The SHA-1 risks discussed in RFC 6194 are resolved by rsa-sha1 no longer being used by DKIM.

email, crypto, security