Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

171–180 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#171

Post by kstrauser »

freedomben wrote: post #157
kstrauser wrote: post #142

Earlier quoted context omitted.

Something like that, as long as you can also prove I hadn’t published the key prior to that. If I publish at random times and to random URL, that may be challenging.

Yes, but then it also encroaches on ability to verify that you were the sender when receiving the original email. Basically, unless the recipient also checks whether the current DKIM key has been published, then they can't trust it because it may be published. If it's being published at random times and to a random URL, then it's nearly impossible to actually check. So I agree that it brings deniability, but I don't…

That’s all true, but I bet 99.99% of all email is delivered within a minute or so of being send. There are exceptions, of course, but in practice the whole thing is pretty fast.

So there’s some threat modeling, too. Are you trying to email someone highly adversarial? Maybe you’re at a law office or such and that’s the case! This wouldn’t help a lot there. Not everyone is immediately forwarding all inbound mails to a timestamping service though.

(I don’t have skin in this game, so I’ll probably duck out after this. I don’t have opinions on whether publishing old DKIM keys is good or bad.)

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#172

Post by stingraycharles »

jgrahamc wrote: post #21

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

Just as an interesting FYI for those who care: the parent poster is the CTO of CloudFlare.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#173

Post by [deleted] »

daneel_w wrote: post #41
woodruffw wrote: post #37

Earlier quoted context omitted.

Ed25519 has seen broad adoption in TLS and other stacks that are used pervasively where DKIM is also used. What’s blocking it for DKIM uniquely? (This isn’t intended as a leading question.)

Everyone has to be onboard before the switch can be made, and not everyone is happy about the somewhat messy solution of running dual-stack RSA+Ed25519 setups in the interim - it's a bit different than e.g. supporting multiple methods for key exchange or multiple ciphers for symmetric crypto. It's just one of those things that take time to happen.

[deleted]

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#174

Post by daneel_w »

jandrese wrote: post #154
throw0101c wrote: post #35

Earlier quoted context omitted.

> Probably because RSA 2048 is not yet broken […] 3072 has been recommended by various parties for a few years now: * https://www.keylength.com

Is there a compelling reason to use 3072 instead of 4096? If you're going to kick the can down the road you might as well put some effort into it. The difference in memory use/compute time has to be marginal at this point. It's not like the old days when jumping from 512 to 4096 made the encryption unusably slow.

There's no good reason at all, which is why RSA-3072 is the rarely seen "oddball".

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#175

Post by upofadown »

GuB-42 wrote: post #87
zelphirkalt wrote: post #4

Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.

RSA-1024 seems to be about 8 million times better than RSA-512, so cracking that would be $64 million in compute. Not NSA-proof, but should be more than enough to keep spammers out, especially considering that DKIM is just one layer of protection.

That's just the extra compute required. There is a large increase in required memory that needs to be quickly accessible in a particular way. One estimate I saw claimed that breaking 1024 bit RSA would take more than 2 billion dollars over a period of years.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#176

Post by upofadown »

DarkmSparks wrote: post #100
littlestymaar wrote: post #31

Earlier quoted context omitted.

1024 is still many orders of magnitude hard to crack than 512. For the record, the last RSA number having been broken was RSA-250 (829 bits) and it took 2700 core-years to crack back in 2020[1]. In comparison, RSA-155 (512 bits) was factorized as early as 1999! You aren't in danger. [1]: https://sympa.inria.fr/sympa/arc/cado-nfs/2020-02/msg00001.h...

There are several open source GNFS tools that can do 1024 very efficiently on GPUs, and even cheap consumer GPUs have 10s of thousands of cores now, even by your measure "2700 core-years" is only around a month or so on a single consumer grade GPU. Not "free", but any malicious actor has access to a lot more than a single GPU. The UK government also has several huge arm based solutions dedicated to cracking internet…

>There are several open source GNFS tools that can do 1024 very efficiently on GPUs, ...

Reference? Why has no one demonstrated this?

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#177

Post by irrational »

singpolyma3 wrote: post #168
jabart wrote: post #129

Earlier quoted context omitted.

Doing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.

As if courts care about any of that. They'll just ask the witness "did you send this email"

https://xkcd.com/538/

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#178

Post by mjl- »

zelphirkalt wrote: post #4

Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.

DKIM records are just DNS TXT records. Do they have a limit on the size of TXT records? Or are they going out of their way to try to parse the TXT records you're adding that look like DKIM records, failing on them, and then refusing to add them?

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#179

Post by dspillett »

sva_ wrote: post #12
dspillett wrote: post #8

How common are such small DKIM keys? I'm pretty sure mine are 2048-bit, though I'd have to check as they were last set a fair while ago.

First sentence: > In our study on the SPF, DKIM, and DMARC records of the top 1M websites, we were surprised to uncover more than 1,700 public DKIM keys that were shorter than 1,024 bits in length

I must do something about my short-term memory/attention. I must have read that and promptly blanked it during the scanning of the rest of the article.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#180

Post by meindnoch »

infogulch wrote: post #145
meindnoch wrote: post #113

Earlier quoted context omitted.

I don't see how this could be possible. If I have some information which I can use to prove that you were the sender, then I can just share the same information with a third party, and they can verify just the same.

Yes it seems crazy, but besides the obvious "leak your own key" as other comments mentioned, this is actually possible. This is one of the biggest discoveries in cryptography in the last decades and its implications are still being researched. I dug around and found this article which seems to do a pretty good job describing the cryptographic concepts of "non-transferability" / "deniability" / "deniable authenticatio…

Hmm. So basically any protocol with a shared key?

I.e. a symmetric key is shared between you and me. If I receive a message with that key, I know it's from you because the key is only known by you and me, and I know I wasn't the sender, so it must be you. But any third party can only say that the message was by one of us.

Post reply on HN