A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM)
updates
- rfc-6376 — DomainKeys Identified Mail (DKIM) Signatures
Extracted elements (11)
Because Ed25519 public keys are only 256 bits (44 base64 octets), DKIM DNS key records will generally fit in a single 255-byte TXT string, avoiding interoperability problems with DNS provisioning software that cannot handle multistring TXT records.
Ed25519 was chosen because it provides similar security levels to RSA with much shorter keys, making it a stronger signing algorithm for DKIM.
For backward compatibility, signers can add multiple DKIM signatures using both old (RSA) and new (Ed25519) algorithms. Because only one key record can exist per selector, the two signatures must use different s= selectors, though they may share the same d= and i= identifiers.
DKIM verifiers MUST implement the Ed25519-SHA256 algorithm. Signers SHOULD implement it as well.
Signers SHOULD implement the Ed25519-SHA256 algorithm, updating the algorithm requirements in Section 3.3 of RFC 6376.
The DKIM algorithm tag grammar is extended: 'sig-a-tag-k =/ "ed25519"' is added to the existing ABNF rule for sig-a-tag-k in RFC 6376, Section 3.5.
The DKIM key tag grammar is extended: 'key-k-tag-type =/ "ed25519"' is added to the existing ABNF rule in RFC 6376, Section 3.6.1. The DNS record for an Ed25519 verification key uses the tag 'k=ed25519'.
The Ed25519-SHA256 signing algorithm computes a message hash using SHA-256 as hash-alg (per RFC 6376 Section 3) and signs the hash with the PureEdDSA variant Ed25519 as defined in RFC 8032, Section 5.1.
The 'DKIM Key Type' registry is updated to add the value 'ed25519' with reference RFC 8032 and status 'active'.
All security advice in RFC 6376 continues to apply, except that the security advice about Ed25519 in RFC 8032, Section 8 supplants the RSA-specific threat advice.
The p= value in an Ed25519 DKIM key record is the 256-bit Ed25519 public key encoded in base64, yielding exactly 44 octets of base64 text.