Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

131–140 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#131

Post by tialaramex »

jagged-chisel wrote: post #90
CodesInChaos wrote: post #73

Earlier quoted context omitted.

When using deniable authentication (e.g. Diffie-Hellman plus a MAC), the recipient can verify that the email came from the sender. But they can't prove to a third party that the email came from the sender, and wasn't forged by the recipient.

Mallory sends a message, forged as if from Alice, to Bob. How can Bob determine that it came from Alice and wasn’t forged by Mallory?

No, no, in these systems Alice and Bob both know a secret. Mallory doesn't know the secret, so, Mallory can't forge such a message.

However, Bob can't prove to the world "Alice sent me this message saying she hates cats!" because everybody knows Bob knows the same secret as Alice, so, that message could just as easily be made by Bob. Bob knows he didn't make it, and he knows the only other person who could was Alice, so he knows he's right - but Alice's cat hatred cannot be proved to others who don't just believe what Bob tells them about Alice.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#132

Post by austin-cheney »

bmenrigh wrote: post #106
austin-cheney wrote: post #99

In case anybody is wondering about whether the 512bit number is big or small it depends on whether it is symmetric or asymmetric encryption technique. Always presume asymmetric encryption is 8x weaker than symmetric encryption. DKIM is asymmetric. So a 512bit DKIM equivalent symmetric hash would be 64bits, which is long broken. Even 160bit SHA1 is considered broken. A DKIM of roughly equivalent strength to a 512bit S…

DKIM is not an encryption algorithm. It is a standard for embedding and validating signatures in email headers. Unfortunately DKIM only supports rsa-sha1 and rsa-sha256 signatures ( https://datatracker.ietf.org/doc/html/rfc6376/#section-3.3 ). It'd be nice to see DKIM get revised to allow Ed25519 or similar signatures.

Wikipedia says it is a correlation check based upon a public key based signature. How is that not a form of encryption? Google says encryption is a process that scrambles data into a secret code that can only be decoded with a unique digital key, which is exactly what public keys are for.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#133

Post by alt227 »

colmmacc wrote: post #84
phoe-krk wrote: post #65

Earlier quoted context omitted.

> for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable They've contacted the company with the vulnerability and resolved it before publishing the article - search the original article for the substring "now no longer available". Usually, you demonstrate that an online system is vulnerable by exploiting that vulnerability in good faith, documenting the research, and sub…

I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not to, but I personally wouldn't allow or recommend a security researcher to do it. It's needlessly risky. In general, subverting security and privacy controls tends to be illegal in most jurisdict…

> If you crack someone's key, they might be well within their rights to pursue a criminal prosecution.

If that were true there would be no market for white hat hackers collecting bug bounties. You need to be able to demonstrate cracking the working system for that to be of any use at all. No company will listen to your theoretical bug exploit, but show them that you can actually break their system and they will pay you well for disclosure.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#134

Post by devmor »

meindnoch wrote: post #113
infogulch wrote: post #81

Earlier quoted context omitted.

It's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it." The fact that this is possible is some cryptography black magic.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

Imagine that yesterday, I had only one house key, and I left a copy of it in your mailbox so you could come into my house to borrow a cup of sugar while I was out. You can be sure I allowed it, because you know I had only one key.

Today, I made 3 copies of my housekey and gave them to friends. You still know that I was the one that allowed you entry into my house, but you can not prove to anyone else that I was the one that made the copy, because there are now 3 other people that could do that.

(For this example, imagine I made the key copies at home and didn't go to a locksmith who could verify when they were made, since we don't need a locksmith to do software crypto)

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#135

Post by brightball »

jgrahamc wrote: post #21

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

Reminds me of the story of a guy cracking one thinking it was a Google headhunting challenge.

https://www.wired.com/2012/10/dkim-vulnerability-widespread/

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#136

Post by colmmacc »

alt227 wrote: post #133
colmmacc wrote: post #84

Earlier quoted context omitted.

I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not to, but I personally wouldn't allow or recommend a security researcher to do it. It's needlessly risky. In general, subverting security and privacy controls tends to be illegal in most jurisdict…

> If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. If that were true there would be no market for white hat hackers collecting bug bounties. You need to be able to demonstrate cracking the working system for that to be of any use at all. No company will listen to your theoretical bug exploit, but show them that you can actually break their system and they will pay y…

Bug bounties are a form of consent for testing and usually come with prescribed limits. Prescribed or not, actually getting user data tends to be a huge no go. Sometimes it can happen inadvertently, and when that happens it's best to have logs or evidence that can demonstrate you haven't looked at it or copied it beyond the inadvertent disclosure.

But to pursue data deliberately crosses a bright line, and is not necessary for security research. Secret keys are data that be used to impersonate or decrypt. I would be very very careful.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#137

Post by myself248 »

lelandfe wrote: post #88
halfmatthalfcat wrote: post #55

Earlier quoted context omitted.

[flagged]

I have stopped mentioning frontend performance being my speciality on interviews as it has elicited tepid responses from all but one.

I imagine interviewing at McMaster-Carr to be a very different experience than Home Depot.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#138

Post by marcosdumay »

RobotToaster wrote: post #94
marcosdumay wrote: post #60

Earlier quoted context omitted.

The key sizes we use today are expected to hold against a Dyson sphere focused on breaking them with the best exploit we know today. What size do you suggest?

It's not quantum-safe though.

Larger keys won't make the algorithms quantum-safe either.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#140

Post by meindnoch »

kstrauser wrote: post #120
meindnoch wrote: post #113

Earlier quoted context omitted.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

The idea is that for spam filtering purposes, you can prove this morning that the email I sent you this morning came from me, because I’m the only person who had the signing key on it. Anyone else could validate that too. But let’s say I publish that signing key tomorrow. Once I do that, you can’t prove I sent today’s mail because anyone could’ve used that published key tomorrow forget the signature.

Ok, so there's a time window where it's possible to prove that you were the sender. And if I use a qualified timestamp service to sign all messages arriving in my inbox, then I can prove that you were the sender indefinitely.
Post reply on HN