Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM)
The cryptographic algorithm and key size requirements included when DomainKeys Identified Mail (DKIM) was designed a decade ago are functionally obsolete and in need of immediate revision. This document updates DKIM requirements to those minimally suitable for operation with currently specified algorithms.
Normative requirements
Every sentence in this RFC carrying an RFC 2119 keyword, with the section it came from. 7 must, 1 should, 0 may.
1 Introduction
- MUST NOTDue to the recognized weakness of the SHA-1 hash algorithm (see [RFC6194]) and the wide availability of the SHA-256 hash algorithm (it has been a required part of DKIM [RFC6376] since it was originally standardized in 2007), the SHA-1 hash algorithm MUST NOT be used.
3.1 Signing and Verification Algorithms
- MUSTSigners MUST sign using rsa-sha256.
- MUSTVerifiers MUST be able to verify using rsa-sha256.
- MUST NOTrsa-sha1 MUST NOT be used for signing or verifying.
3.2 Key Sizes
- MUSTSince short RSA keys more easily succumb to off-line attacks, Signers MUST use RSA keys of at least 1024 bits for all keys.
- SHOULDSigners SHOULD use RSA keys of at least 2048 bits.
- MUSTVerifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096 bits, and they MAY be able to validate signatures with larger keys.
- MUST NOTVerifiers MUST NOT consider signatures using RSA keys of less than 1024 bits as valid signatures.