> Small nitpick: LWSP is defined (informationally) but not used. > For key types/algorithm strings, we have key type "rsa" for algorithm > "rsa-sha256", similar for ed25519. > But somehow, for the PQ hybrid, "sha512" is suffixed to the _key type_ too? > Aren't the key types agnostic/orthogonal to the hash function? > So shouldn't the key type (DNS k=) be "mldsa44-ed25519" (but the algorithm > part in s= in DKIM2-Signature be "mldsa44-ed25519-sha512")?
+1 from an implementer's point of view. I have implemented the new key type in mail-auth (the Rust library behind Stalwart's DKIM2 support), and in the code the key type and the signature algorithm are already two different things: the key record says what kind of public key is in p=, and the s= entry says which algorithm and hash to use with it. Having the hash in k= only works as long as there is exactly one hash per key type. If the group follows Richard's suggestion to allow both the -sha256 and -sha512 variants of each algorithm, the same key would need two different k= values, which is the situation "rsa" and "ed25519" were designed to avoid. The same applies if plain ML-DSA-44 is chosen: "mldsa44" for k=, and "mldsa44-sha256" or "mldsa44-sha512" for the algorithm. Two editorial points on how the two drafts fit together, which I ran into while updating mail-auth to draft-ietf-dkim-dkim2-spec-07: - -07 still cites draft-chuang-dkim2-dns-04 as [DKIMKEYS]. That draft has been replaced by draft-ietf-dkim-dkim2-dns and does not define the new key type, so the reference should point to draft-ietf-dkim-dkim2-dns. - Section 3 of -07 says "Verifiers MUST implement all five algorithms", while Section 3.3 of dns-01 says Signers and Verifiers "SHOULD implement ed25519-sha256 and mldsa44-ed25519-sha512". Whatever the final list of algorithms is, the two drafts should say the same thing. If it helps anyone check their key records, the mail-auth playground at https://mail-auth.stalw.art generates keys for rsa, ed25519 and mldsa44-ed25519 and shows the resulting DNS TXT record, split into strings of at most 255 bytes. It currently uses k=mldsa44-ed25519-sha512 as dns-01 says, and I will update it if the name changes. Best, Mauro _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
