-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, IETF
- -- Bastian Buck <[email protected]> writes
>DKIMv2 will support PQC in the form of ML-DSA-44, which is great and very
>important for future attacks by CRQCs.
if such devices ever exist
> DKIM1 has not been updated since RFC 8463
>and is considered insecure against quantum adversaries.
I am not losing sleep over that
>Since users are unlikely to switch directly to DKIM2, my proposal is to add a
>PQ-secure variant to DKIM1 as well (similar to Ed25519).
Similar to Ed25519 is a key point here.
What Ed25519 has shown us is that almost no-one will implement ANY new
algorithm for DKIM1 because there is absolutely no use case for doing so
and engineering effort will be applied to DKIM2 instead. Some people
have not even got the memo about SHA-1 or short RSA keys.
The promoters of SM2 and SM3 would do well to pay attention to this as
well -- though in their case they are promoting "nation-state-crypto"
and so there may be incentives going beyond the merely technical.
The issue of incentives and engineering effort is precisely why we
picked a PQ algorithm for DKIM2 at this stage of its development and put
it into the spec with MUST instructions. We can change which PQ
algorithm we choose up until Auth48 -- after that to all practical
intents and purposes we will be stuck with our choice until DKIM3 turns
up in the mid 2050s.
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBaujEDmHfC/FfW545EQLIvwCfVwYY0qPwkwThBREpK2eHyWfrffcAoJoY
y2o5L7ySFINESXjCg9JWaqFS
=jLrc
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
