Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

211–220 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#211

Post by throw0101c »

jandrese wrote: post #206
throw0101c wrote: post #205

Earlier quoted context omitted.

> There's no good reason at all Operations per second? * https://wiki.strongswan.org/projects/strongswan/wiki/PublicK... Running MacPorts-installed `openssl speed rsa` on an Apple M4 (non-Pro): version: 3.4.0 built on: Tue Dec 3 14:33:57 2024 UTC options: bn(64,64) compiler: /usr/bin/clang -fPIC -arch arm64 -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX15.sdk -arch arm64 -isysroot /Library/Develop…

It's roughly half as fast as 4096, which sounds bad until you realize that 3072 is already 20% as fast as 2048, 3% as fast as 1024, and 1% as fast as 512. In terms of performance tradeoff it's downright mild compared to the other steps up.

If I could waive a magic wand and get a 40-100% performance boost on a service by changing 3-4 characters (s/4096/3072/) why wouldn't I take it? (Assuming I need security go to beyond RSA 2028.)

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#212

Post by matthewdgreen »

GTP wrote: post #47
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

Isn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?

Do take a look at the blog post I cited above, where I go into this in loads of detail. The TL;DR is that DKIM only needs to ensure origin authenticity for the time it takes to deliver an email, which is usually a few hours or a day at most.

The unintentional problem DKIM is causing is that it actually provides non-repudiation for many years. Those signed emails can sit in someone's mailbox for years, then get stolen by a hacker. The hacker can then blackmail the owner by threatening to dump the email trove, or for newsworthy targets they can just do it. Reasonable people (e.g., high-integrity newspapers, courts of law) will say "how can we trust that these stolen emails are authentic given that there's no chain of custody?" DKIM signatures nearly answer that question, which makes stolen emails much more valuable than they would be otherwise.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#213

Post by paulnpace »

1oooqooq wrote: post #125
paulnpace wrote: post #56

Earlier quoted context omitted.

DKIM supports Ed25519-SHA256. https://datatracker.ietf.org/doc/html/rfc8463

specs supports many things. I believe the question was more about the real world.

In the real world, DKIM specs only support Ed25519 and RSA.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#214

Post by kbolino »

EVa5I7bHFq9mnYK wrote: post #188
bananapub wrote: post #10

Earlier quoted context omitted.

> why we're not dramatically ramping up key sizes across the board on all encryption? because no one thinks there is a reason to, no one has any fear that classical computers will catch up with RSA-2048/AES-128 before their grand children are dead. post-quantum crypt stuff is happening and people are planning how to migrate to it.

Well, even MD4 hasn't been cracked yet.

What is your definition of cracked? Collisions are easy to produce; there's one right on the Wikipedia page.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#215

Post by matthewdgreen »

marcosdumay wrote: post #53
GTP wrote: post #47

Earlier quoted context omitted.

Isn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?

Yes. Deniability and perfect forward secrecy are at odds with how people use email anyway. But that doesn't stop people from demanding both very loudly, and some people from promising them.

I don't know what you're saying. Most email isn't encrypted so PFS wouldn't apply to the content of email messages. When you mention PFS are you talking about email encrypted with something like GPG/PGP? Or are you talking about PFS in the context of the TLS connections used to protect SMTP? I'm not sure what "deniability" refers to in your post and how you think people use email in ways that would contraindicate it. Once I understand what you're saying, I guess we could move on to who the demanders and promisers are and what you think they're doing.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#216

Post by matthewdgreen »

anonym29 wrote: post #103
lupusreal wrote: post #74

Earlier quoted context omitted.

Meanwhile in the real world, screenshots of emails without any cryptographic authentication at all are good enough to send people to prison.

I absolutely believe you - lawyers, judges, and juries alike tend to be technologically illiterate, but do you have any references/links to this happening?

If you read the blog post, you'll see that newspapers frequently verify DKIM signatures on stolen email corpora before they publish about them. Eg: https://www.propublica.org/nerds/authenticating-email-using-...

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#217

Post by kbolino »

1oooqooq wrote: post #119
mrweasel wrote: post #51

Earlier quoted context omitted.

The interesting question is: Did these sites forget that they have these records, or have they perhaps forgot how to rotate their keys.

dns server limitations. txt records are 1024bits... add the prefix for the key and you get to use a larger key you must combine many txt records in a never ending comical interoperability issues. the first one usually being that your regional monopoly scoundrel, a.k.a. registrar, run a server which doesn't even allow more than one entry.

TXT records are 255 bytes or 2040 bits. This is plenty of space to support RSA-1024 keys even with a small prefix and after base64 encoding them. However, it is obviously not enough to support RSA-2048 which is the minimum recommended size according to NIST right now. It's also not quite enough even for RSA-1536 (not widely used) due to base64 expanding the key by 33%.

There actually is a standard for adding more than 255 bytes to a TXT record and it's fairly widely supported, but it can be tricky to configure properly on a name server.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#219

Post by matja »

matthewdgreen wrote: post #39
jgrahamc wrote: post #21

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

I don't think this rationale is correct. DKIM doesn't authenticate a user, since the user doesn't the private key - DKIM authenticates that the MTA knows the private key on behalf of the domain owner, which isn't necessarily the users using that domain to send email.

What's more dangerous is that a jury wouldn't know the difference.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#220

Post by TomK32 »

tialaramex wrote: post #131
jagged-chisel wrote: post #90

Earlier quoted context omitted.

Mallory sends a message, forged as if from Alice, to Bob. How can Bob determine that it came from Alice and wasn’t forged by Mallory?

No, no, in these systems Alice and Bob both know a secret. Mallory doesn't know the secret, so, Mallory can't forge such a message. However, Bob can't prove to the world "Alice sent me this message saying she hates cats!" because everybody knows Bob knows the same secret as Alice, so, that message could just as easily be made by Bob. Bob knows he didn't make it, and he knows the only other person who could was Alice,…

Now it makes sense why Alice was sending me that kitten in a mixer video.

But seriously, in a case before a court or jury, wouldn't there be much more evidence? Down to your own lawyer sending a complete dump of your phone with all those Sandy-Hooks-conspiracies and hate messages to the opposing side?

Post reply on HN