Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

221–230 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#221

Post by mjl- »

nyrikki wrote: post #199
mjl- wrote: post #178

Earlier quoted context omitted.

DKIM records are just DNS TXT records. Do they have a limit on the size of TXT records? Or are they going out of their way to try to parse the TXT records you're adding that look like DKIM records, failing on them, and then refusing to add them?

RFC1035 imposes a 255 character limit per string on TXT records .

Yes, so you use multiple strings (in a single record) if you need longer values:

"first 255 bytes" "second 255 bytes" "etc"

DNS clients combine the 255-byte strings back into a single string.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#222

Post by DarkmSparks »

littlestymaar wrote: post #191
DarkmSparks wrote: post #100

Earlier quoted context omitted.

There are several open source GNFS tools that can do 1024 very efficiently on GPUs, and even cheap consumer GPUs have 10s of thousands of cores now, even by your measure "2700 core-years" is only around a month or so on a single consumer grade GPU. Not "free", but any malicious actor has access to a lot more than a single GPU. The UK government also has several huge arm based solutions dedicated to cracking internet…

Yet nobody is collecting the RSA-numbers bounties? RSA-270 (much, much easier than 1024 compute-wise) has a bounty of $75k, why would it be unclaimed then when you can spend three years worth of cloud rented H100 (I'm being conservative here and count $3/h which is far from the best deal you can get) and still make a profit? Also a GPU core and CPU cores really aren't comparable individually, so your “consumer graphi…

had a bounty. the RSA challenge unexpectly finished in 2007, task is left to the reader to speculate what happened in 2007.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#223

Post by jrpelkonen »

throw0101c wrote: post #211
jandrese wrote: post #206

Earlier quoted context omitted.

It's roughly half as fast as 4096, which sounds bad until you realize that 3072 is already 20% as fast as 2048, 3% as fast as 1024, and 1% as fast as 512. In terms of performance tradeoff it's downright mild compared to the other steps up.

If I could waive a magic wand and get a 40-100% performance boost on a service by changing 3-4 characters (s/4096/3072/) why wouldn't I take it? (Assuming I need security go to beyond RSA 2028.)

Well, in typical use cases RSA usage is very limited (eg some operations during TLS handshake), so the 40-100% boost wouldn’t be across the board, but likely shave some milliseconds per connection.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#225

Post by littlestymaar »

DarkmSparks wrote: post #222
littlestymaar wrote: post #191

Earlier quoted context omitted.

Yet nobody is collecting the RSA-numbers bounties? RSA-270 (much, much easier than 1024 compute-wise) has a bounty of $75k, why would it be unclaimed then when you can spend three years worth of cloud rented H100 (I'm being conservative here and count $3/h which is far from the best deal you can get) and still make a profit? Also a GPU core and CPU cores really aren't comparable individually, so your “consumer graphi…

had a bounty. the RSA challenge unexpectly finished in 2007, task is left to the reader to speculate what happened in 2007.

Oh, I wasn't aware of the end of the challenge. But 1024 was definitely not broken by then, at least not by brute force.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#226

Post by reaperman »

TomK32 wrote: post #220
tialaramex wrote: post #131

Earlier quoted context omitted.

No, no, in these systems Alice and Bob both know a secret. Mallory doesn't know the secret, so, Mallory can't forge such a message. However, Bob can't prove to the world "Alice sent me this message saying she hates cats!" because everybody knows Bob knows the same secret as Alice, so, that message could just as easily be made by Bob. Bob knows he didn't make it, and he knows the only other person who could was Alice,…

Now it makes sense why Alice was sending me that kitten in a mixer video. But seriously, in a case before a court or jury, wouldn't there be much more evidence? Down to your own lawyer sending a complete dump of your phone with all those Sandy-Hooks-conspiracies and hate messages to the opposing side?

Sometimes instead of a complete dump, you might mutually agree on a third party forensic lab to analyze your phone and only provide relevant details to the opposing side. Usually there's a few rounds of review where you can remove some details/records that are not relevant before the distilled records are sent to the opposing counsel.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#227

Post by throw0101c »

Avamander wrote: post #78
woodruffw wrote: post #37

Earlier quoted context omitted.

Ed25519 has seen broad adoption in TLS and other stacks that are used pervasively where DKIM is also used. What’s blocking it for DKIM uniquely? (This isn’t intended as a leading question.)

X25519 has seen broad adoption (in the key exchange). Ed25519 has not, you can't actually use an Ed25519 certificate on the web. It's in a deadlock between CAs, browsers and TPM manufacturers (and to some extent NIST, because Ed25519 has not been approved by them). It's not being blocked per se, you can use it mostly (98%) without any issues. Though things like Amazon SES incorrectly reject letters with multiple sign…

> (and to some extent NIST, because Ed25519 has not been approved by them).

Ed25519 (and Ed448) have been approved for use in FIPS 186-5 as of February 2023:

* https://en.wikipedia.org/wiki/EdDSA#Standardization_and_impl...

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#228

Post by reaperman »

lupusreal wrote: post #74
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

Meanwhile in the real world, screenshots of emails without any cryptographic authentication at all are good enough to send people to prison.

Only if the defendant doesn't challenge the evidence. If I'm the defendant and I know I sent those emails, I'm not going to challenge the screenshot. If I know I did not send those emails, then I'll do my best to pay for forensic analysts to generate evidence to exonerate me.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#229

Post by EVa5I7bHFq9mnYK »

kbolino wrote: post #214
EVa5I7bHFq9mnYK wrote: post #188

Earlier quoted context omitted.

Well, even MD4 hasn't been cracked yet.

What is your definition of cracked? Collisions are easy to produce; there's one right on the Wikipedia page.

Collisions are not interesting. Millions of leaked passwords hashed with MD4/MD5 are of very practical interest.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#230

Post by matja »

DarkmSparks wrote: post #83

"as RSA keys shorter than 1,024 bits are considered insecure, and their use in DKIM has been deprecated since the introduction of RFC 8301 in 2018." LOL. One of my favourite internet flame wars was circa 2007 (in and around discussing the incoming financial crises) and we got talking about encryption and how none of it actually "works". Particularly vile troll, and iirc also owner of the site bet me $50,000 I couldn'…

Was it a key affected by CVE-2008-0166 ? :)
Post reply on HN