Because we need that compute for our React frameworks.
[flagged]
[deleted]
Cracking a 512-bit DKIM key for less than $8 in the cloud
101–110 of 433 posts
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#102Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).
we are definitely not.
most countries registrar's won't support DNS hacks requied for larger dkim.
we still use the minimum key size in most countries.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#103Earlier quoted context omitted.
For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…
Meanwhile in the real world, screenshots of emails without any cryptographic authentication at all are good enough to send people to prison.
I absolutely believe you - lawyers, judges, and juries alike tend to be technologically illiterate, but do you have any references/links to this happening?
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#104Earlier quoted context omitted.
RSA-1024 seems to be about 8 million times better than RSA-512, so cracking that would be $64 million in compute. Not NSA-proof, but should be more than enough to keep spammers out, especially considering that DKIM is just one layer of protection.
512 extra bits of key only gets you 23 bits of entropy?
Yep, the formula is a bit complicated, it comes from the general number field sieve (GNFS) algorithm, you can find some equivalences online between symmetric key algorithms and RSA and 23 bits seems about right. I have also seen lists where they give RSA-512 64 bits and RSA-1024 80 bits, just a 16 bit difference, but it looks a bit arbitrary to me. I think the NIST doesn't even look at RSA-512 anymore, as it is definitely broken, it only starts at 1024.
A RSA key is the product of two primes, not any number, so you need a lot more bits to get equivalent security to, say, AES. That's also a reason for elliptic-curve cryptography, which needs a lot less bits than RSA for the same level of security.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#105> Although most providers correctly identified the 512-bit key as insecure and rejected our DKIM signature, three major providers — Yahoo Mail, Mailfence, and Tuta — reported a dkim=pass result.
Did google really FAIL because of DKIM signature being insecure or because SPF failed?
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#106In case anybody is wondering about whether the 512bit number is big or small it depends on whether it is symmetric or asymmetric encryption technique. Always presume asymmetric encryption is 8x weaker than symmetric encryption. DKIM is asymmetric. So a 512bit DKIM equivalent symmetric hash would be 64bits, which is long broken. Even 160bit SHA1 is considered broken. A DKIM of roughly equivalent strength to a 512bit S…
DKIM is not an encryption algorithm. It is a standard for embedding and validating signatures in email headers.
Unfortunately DKIM only supports rsa-sha1 and rsa-sha256 signatures (https://datatracker.ietf.org/doc/html/rfc6376/#section-3.3). It'd be nice to see DKIM get revised to allow Ed25519 or similar signatures.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#107Earlier quoted context omitted.
Yikes. NIST wants to forbid even 2048-bit RSA by 2035, because it doesn't offer a good enough security level.
2048 achieves the same security level NIST requires from AEADs, doesn't it? What plausibly attacks it? Pushing people past 2048 seems counterproductive.
It should achieve the same level, yes. It's not exactly described what could attack it. Right now it seems that 2048-bits would be the last allowed step and they're not going to push people past 2048, they want to phase out RSA in general.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#108Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
because everyone recommending those things work on both sides.
they recommend 2048 and use 4096 themselves because if they need to ever break your 2048 it's less bad than if you were recommended to use 4069. wink wink
same with everyone recommending ed22519 when ed448 is as good and as fast to encode. but all the arguments point to encode speed from a Bernstein paper which used a pentium iii!
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#109Earlier quoted context omitted.
We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).
we are definitely not. most countries registrar's won't support DNS hacks requied for larger dkim. we still use the minimum key size in most countries.
What? Just use normal name servers. The registrar doesn't matter one bit, they delegate the zone to whatever name servers you specify. Those can serve whatever records properly.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#110In case anybody is wondering about whether the 512bit number is big or small it depends on whether it is symmetric or asymmetric encryption technique. Always presume asymmetric encryption is 8x weaker than symmetric encryption. DKIM is asymmetric. So a 512bit DKIM equivalent symmetric hash would be 64bits, which is long broken. Even 160bit SHA1 is considered broken. A DKIM of roughly equivalent strength to a 512bit S…
DKIM is not an encryption algorithm. It is a standard for embedding and validating signatures in email headers. Unfortunately DKIM only supports rsa-sha1 and rsa-sha256 signatures ( https://datatracker.ietf.org/doc/html/rfc6376/#section-3.3 ). It'd be nice to see DKIM get revised to allow Ed25519 or similar signatures.
Ed25519-SHA256 support has existed for a while now.