Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

111–120 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#111
post #47

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

Isn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?

That's not quite what he's saying.

DKIM's goal is that the receiving system can trust that the message presented to it has come from a host that knows the key, and so could sign it. At the time that message is received, you should be able to assume that only people authorised to send from that domain are able to do so.

By publishing older keys, you gain deniability back, because anybody could have forged the message and signed it. Even if you have timestamps that show when you received the message, the onus is one you to prove that those timestamps are not fabricated. This is a much harder problem because secrets can be revealed later but not forgotten.

To be able to prove that you did it fact receive the message on that date, you'd probably have to record e.g. the message ID, signature and timestamp (perhaps all encrypted with a key that you can reveal later) on a blockchain, which would then serve as proof of when the message was received. Even then, you'd still have to prove that the key hadn't been disclosed before that time.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#112
post #92
post #87

Earlier quoted context omitted.

RSA-1024 seems to be about 8 million times better than RSA-512, so cracking that would be $64 million in compute. Not NSA-proof, but should be more than enough to keep spammers out, especially considering that DKIM is just one layer of protection.

512 extra bits of key only gets you 23 bits of entropy?

[deleted]

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#113

Earlier quoted context omitted.

What's the problem with verifiable email? You can just delete old emails (if gmail or whoever archives them that's another problem). Most people probably operate under the assumption that email is verifiable in some way anyway. If you receive malicious email, isn't it a good thing to be able to verify where it came from? Doesn't that benefit senders and receivers alike? Or is this a case of "I want to verify you, but…

It's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it." The fact that this is possible is some cryptography black magic.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#114

Earlier quoted context omitted.

DKIM is not an encryption algorithm. It is a standard for embedding and validating signatures in email headers. Unfortunately DKIM only supports rsa-sha1 and rsa-sha256 signatures ( https://datatracker.ietf.org/doc/html/rfc6376/#section-3.3 ). It'd be nice to see DKIM get revised to allow Ed25519 or similar signatures.

Ed25519-SHA256 support has existed for a while now. https://datatracker.ietf.org/doc/html/rfc8463

Oh excellent. I didn't realize rfc6376 had been superseded.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#115

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

> "Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware." So we went to a few weeks to 8h in 14 years give or take

86h, wasn't it? But regardless your point stands.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#116
post #57

Earlier quoted context omitted.

> Probably because RSA 2048 is not yet broken […] 3072 has been recommended by various parties for a few years now: * https://www.keylength.com

RSA 2048 isn't broken, but experts consider it a matter of time. How long I don't know, but since the attacks are known (prime numbers) someone (read not me) can make an estimate with error bars that are concerning enough to consider it as good as broken.

AFAIK even RSA 1024 isn't broken yet.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#117

Earlier quoted context omitted.

> for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable They've contacted the company with the vulnerability and resolved it before publishing the article - search the original article for the substring "now no longer available". Usually, you demonstrate that an online system is vulnerable by exploiting that vulnerability in good faith, documenting the research, and sub…

I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not to, but I personally wouldn't allow or recommend a security researcher to do it. It's needlessly risky. In general, subverting security and privacy controls tends to be illegal in most jurisdict…

They can pursue what they want, it doesn't mean it will go through.

Looking at public data, using some other public knowledge to figure out something new does not make it inherently illegal. They didn't crack it on their systems, they didn't subvert it on their systems, they did not use it against their systems. I'd love to see some specific examples under what it could be prosecuted under specifically. Because "that door doesn't actually have a lock" or "the king doesn't actually have clothes" is not practically prosecutable anywhere normal just like that.

Especially in the EU, making such cryptographic blunders might even fall foul of NIS2, should it apply to you.

In general this also quickly boils down to the topic of "illegal numbers" (https://en.wikipedia.org/wiki/Illegal_number) as well.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#118
post #52

Earlier quoted context omitted.

I published the article today, though it was written a few months ago (when the DKIM record was still online).

Was redfin aware you were trying to break their DKIM record?

It was already broken.

This comment also serves as a public notice that I'm going to factor all the 512-bit DKIM RSA keys out there from now on. Start migrating.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#119
post #12

Earlier quoted context omitted.

First sentence: > In our study on the SPF, DKIM, and DMARC records of the top 1M websites, we were surprised to uncover more than 1,700 public DKIM keys that were shorter than 1,024 bits in length

The interesting question is: Did these sites forget that they have these records, or have they perhaps forgot how to rotate their keys.

dns server limitations.

txt records are 1024bits... add the prefix for the key and you get to use a larger key you must combine many txt records in a never ending comical interoperability issues. the first one usually being that your regional monopoly scoundrel, a.k.a. registrar, run a server which doesn't even allow more than one entry.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#120

Earlier quoted context omitted.

It's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it." The fact that this is possible is some cryptography black magic.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

The idea is that for spam filtering purposes, you can prove this morning that the email I sent you this morning came from me, because I’m the only person who had the signing key on it. Anyone else could validate that too.

But let’s say I publish that signing key tomorrow. Once I do that, you can’t prove I sent today’s mail because anyone could’ve used that published key tomorrow forget the signature.

Post reply on HN