Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

141–150 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#141

Post by awulf »

mrweasel wrote: post #51
sva_ wrote: post #12

Earlier quoted context omitted.

First sentence: > In our study on the SPF, DKIM, and DMARC records of the top 1M websites, we were surprised to uncover more than 1,700 public DKIM keys that were shorter than 1,024 bits in length

The interesting question is: Did these sites forget that they have these records, or have they perhaps forgot how to rotate their keys.

I guess most of these keys are decades old and no longer in use. They're likely just sitting in the DNS because someone forgot to delete them. Now, no one's sure if they're still needed and is afraid to remove them in case it breaks something. Or maybe they're still used by a legacy system, and no one realizes the impact an old DKIM record could have.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#142

Post by kstrauser »

meindnoch wrote: post #140
kstrauser wrote: post #120

Earlier quoted context omitted.

The idea is that for spam filtering purposes, you can prove this morning that the email I sent you this morning came from me, because I’m the only person who had the signing key on it. Anyone else could validate that too. But let’s say I publish that signing key tomorrow. Once I do that, you can’t prove I sent today’s mail because anyone could’ve used that published key tomorrow forget the signature.

Ok, so there's a time window where it's possible to prove that you were the sender. And if I use a qualified timestamp service to sign all messages arriving in my inbox, then I can prove that you were the sender indefinitely.

Something like that, as long as you can also prove I hadn’t published the key prior to that. If I publish at random times and to random URL, that may be challenging.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#143

Post by colmmacc »

Avamander wrote: post #117
colmmacc wrote: post #84

Earlier quoted context omitted.

I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not to, but I personally wouldn't allow or recommend a security researcher to do it. It's needlessly risky. In general, subverting security and privacy controls tends to be illegal in most jurisdict…

They can pursue what they want, it doesn't mean it will go through. Looking at public data, using some other public knowledge to figure out something new does not make it inherently illegal. They didn't crack it on their systems, they didn't subvert it on their systems, they did not use it against their systems. I'd love to see some specific examples under what it could be prosecuted under specifically. Because "that…

It's more like the door has a weak lock that can be picked. Just like many real world doors do. Here's how it would go in court:

"Are you aware that this key could be used to decrypt information and impersonate X?"

"Are you aware that this key is commonly called a Private key?"

"Are you aware that this key is commonly called a Secret key?"

"Are you aware that it is common to treat these with high sensitivity? Protecting them from human eyes, using secure key management services and so on?"

"Was it even necessary to target someone else's secret private key to demonstrate that 512-bit keys can be cracked?"

"Knowing all of this, did you still willfully and intentionally use cracking to make a copy of this secret private key?"

I wouldn't want to be in the position of trying to explain to a prosecutor, judge, or jury why it's somehow ok and shouldn't count. The reason I'm posting at all here is because I don't think folks are thinking this risk through.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#144

Post by Ar-Curunir »

linsomniac wrote: post #40
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

I forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a level of deniability.

That was Matt Green, the person you replied to =)

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#145

Post by infogulch »

meindnoch wrote: post #113
infogulch wrote: post #81

Earlier quoted context omitted.

It's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it." The fact that this is possible is some cryptography black magic.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

Yes it seems crazy, but besides the obvious "leak your own key" as other comments mentioned, this is actually possible. This is one of the biggest discoveries in cryptography in the last decades and its implications are still being researched. I dug around and found this article which seems to do a pretty good job describing the cryptographic concepts of "non-transferability" / "deniability" / "deniable authentication" for a lay audience: https://dinhtta.github.io/zkp/ Also: https://en.wikipedia.org/wiki/Deniable_authentication

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#146

Post by Ar-Curunir »

jagged-chisel wrote: post #90
CodesInChaos wrote: post #73

Earlier quoted context omitted.

When using deniable authentication (e.g. Diffie-Hellman plus a MAC), the recipient can verify that the email came from the sender. But they can't prove to a third party that the email came from the sender, and wasn't forged by the recipient.

Mallory sends a message, forged as if from Alice, to Bob. How can Bob determine that it came from Alice and wasn’t forged by Mallory?

The idea is to use a MAC instead of a signature. As long as Alice isn't compromised and sharing her key with Mallory (which she could do even in the signature case), when Bob receives a message with a valid MAC on it, he knows that Alice authorized the message.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#147

Post by daneel_w »

lostmsu wrote: post #116
bluGill wrote: post #57

Earlier quoted context omitted.

RSA 2048 isn't broken, but experts consider it a matter of time. How long I don't know, but since the attacks are known (prime numbers) someone (read not me) can make an estimate with error bars that are concerning enough to consider it as good as broken.

AFAIK even RSA 1024 isn't broken yet.

RSA-1024 is "only" 80 symmetric equivalent bits. It's a space requiring a tremendous amount of energy to explore, though I personally consider it very likely that the NSA and/or the MSS et al. have poured immense funds into accelerators specifically targeting RSA, and for them there'd be no obstacles at all to be granted an allocation for such energy consumption.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#149

Post by awulf »

dizhn wrote: post #105

> Although most providers correctly identified the 512-bit key as insecure and rejected our DKIM signature, three major providers — Yahoo Mail, Mailfence, and Tuta — reported a dkim=pass result. Did google really FAIL because of DKIM signature being insecure or because SPF failed?

The DKIM verification failed with the result "dkim=policy (weak key)," as it should according to RFC 8301: "Verifiers MUST NOT consider signatures using RSA keys of less than 1024 bits as valid signatures."
Post reply on HN