4 ms·
That would be RFC8463 "A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM)" [0] The biggest improvement on using EC over RSA in DKIM is
by LeonM 6y ago
That would be RFC8463 "A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM)" [0]
The biggest improvement on using EC over RSA in DKIM is that the public key will fit in a single DNS TXT rr.
The problem here is that email servers are often horribly outdated, so don't expect widespread adoption of the new RFC anytime soon.
The suggested transition method would be include both a EC and RSA signature in the email, and publish both keys under separate selectors. The receiver should ignore the EC signature if it doesn't support it, and when it is supported the receiver should only use the EC signature. However, it wouldn't surprise me of this is going to be poorly implemented and you'll en up with the receiver validating both signatures, thus performing multiple DNS lookups.
I'm planning on doing a write-up about support for RFC8463 in popular email services.
Disclaimer: Founder of an email hardening service.
[0] https://www.rfc-editor.org/rfc/rfc8463.html https://www.rfc-editor.org/rfc/rfc8463.html
- denysvitali 6y agoI wanted to point out this thing because I'm in the middle of migrating my mail server and wanted to improve the whole setup by using chasquid and a set of dkim tools [1] that I've forked an improved to include ed25519-sha256. Unfortunately pretty much nobody has implemented RFC8463 yet, and my DNS provider doesn't allow me to use RSA 2048bit DKIM keys because they have a stupid limit on the TXT field value :( [1]: https://github.com/denysvitali/dkim https://github.com/denysvitali/dkim
- LeonM 6y agoYou shouldn't rely on only ed25519 for DKIM, always double-sign your email with RSA as a fallback The problem with email will forever be that there are so many badly configured email servers out there. Any new standard in email will always need a backwards compatibility ad infinitum. In your case I'd recommend moving your DNS to another DNS provider. Just pick any and go with that.