Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

251–260 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#251

Post by JackSlateur »

matja wrote: post #219
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

I don't think this rationale is correct. DKIM doesn't authenticate a user, since the user doesn't the private key - DKIM authenticates that the MTA knows the private key on behalf of the domain owner, which isn't necessarily the users using that domain to send email. What's more dangerous is that a jury wouldn't know the difference.

Ha, at least ! Thank you for the comment.

If there is some mail from my addr, with a valid DKIM signature, it proves nothing: - perhaps the mail was sent by somebody else on the same plateform, but in my name (identity usurpation of the user part of the mail) - perhaps somebody got illegal access to my email account, without me knowing - .. ?

In no case it proves that I, as a human, sent this email.

But of course, justice is a fiction that cannot exist: there is no justice, only probabilities (and feelings :( ).

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#252

Post by tptacek »

bluGill wrote: post #209
tptacek wrote: post #96

Earlier quoted context omitted.

What expert considers it a matter of time before 2048 is broken? 2048 is 112-bit-equivalent security.

https://www.keylength.com/en/4/ NIST says 2048 bit RSA is good until 2030. I'm not sure what that means, perhaps that it will be broken considering advances, perhaps just that someone (read governments) who cares to spend 5 years on the problem will break your key.

No, we are not in fact 5 years from breaking RSA-2048.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#253

Post by sedatk »

tptacek wrote: post #95
Havoc wrote: post #6

Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…

We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).

People might be assuming that 2048-bits is only twice as strong as 1024-bits, but it's in fact a billion times better. (corrected, thanks!)

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#254

Post by JackSlateur »

Havoc wrote: post #6

Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…

Old but still relevant: https://www.schneier.com/blog/archives/2009/09/the_doghouse_...

  These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
Long story short, brute forcing AES256 or RSA4096 is physically impossible

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#255

Post by cbozeman »

withinboredom wrote: post #237
speerer wrote: post #235

Earlier quoted context omitted.

Counter-example: I've used DKIM as evidence in court.

Counter-example example: I've been an expert witness in court to prove an email was a forgery; using DKIM.

That would be a counter-counterexample, wouldn't it?

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#256

Post by rstuart4133 »

tptacek wrote: post #196
GTP wrote: post #47

Earlier quoted context omitted.

Isn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?

No. DKIM is meant to apply to emails in transit; it is part of the transaction of exchanging emails. But DKIM signatures are verifiable long after that transaction has completed. That was not an intended feature of DKIM, and it's a grave privacy violation. To satisfy DKIM's design goal, you only need a "current" DKIM key that is secure for a window of time. When that window of time passes, you rotate the secret and p…

> it's a grave privacy violation.

I'm missing something here. DKIM mostly proves an email from person@from.me was sent by a server @from.me controls. There is also a bloody great audit trail inside of the email with together with SPF can do a pretty good job of proving the same thing.

I'm struggling to see how an email sent to me, that presumably was always intended to be readable by me could suddenly become a privacy violation because it's signed. That is doubly so if I won't receive it if it isn't validly signed when it is received, which is often the case.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#257

Post by speerer »

withinboredom wrote: post #237
speerer wrote: post #235

Earlier quoted context omitted.

Counter-example: I've used DKIM as evidence in court.

Counter-example example: I've been an expert witness in court to prove an email was a forgery; using DKIM.

It'd be funny if we were working together and just telling the same story behind our aliases.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#258

Post by rstuart4133 »

ryan-c wrote: post #239
jonahx wrote: post #234

Earlier quoted context omitted.

> To satisfy DKIM's design goal, you only need a "current" DKIM key that is secure for a window of time. When that window of time passes, you rotate the secret and publish your own key, repairing (hopefully) much of the privacy injury. If this occurs, is DKIM privacy safe? To make sure I understand, by publishing the private key after a period, that allows for repudiation, since any real email at that point could hav…

Repudiation is the goal.

Repudiation doesn't work if the receive discards the email if it isn't signed, or marks it as DKIM validated when it is received. Many receivers using independent email providers like gmail, so the sender has no control over whether it happens or not. Both practices are common today, so it likely it does happen.

Rotating the key does make the claim "I have proof he sent it" a litter weaker, as it's no longer as easy to prove. But only a little as "your honour, it is marked as DKIM verified by the independent email provider he uses" is pretty solid.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#259

Post by tialaramex »

TomK32 wrote: post #220
tialaramex wrote: post #131

Earlier quoted context omitted.

No, no, in these systems Alice and Bob both know a secret. Mallory doesn't know the secret, so, Mallory can't forge such a message. However, Bob can't prove to the world "Alice sent me this message saying she hates cats!" because everybody knows Bob knows the same secret as Alice, so, that message could just as easily be made by Bob. Bob knows he didn't make it, and he knows the only other person who could was Alice,…

Now it makes sense why Alice was sending me that kitten in a mixer video. But seriously, in a case before a court or jury, wouldn't there be much more evidence? Down to your own lawyer sending a complete dump of your phone with all those Sandy-Hooks-conspiracies and hate messages to the opposing side?

Deniability is just that, the opportunity to deny. Will denying change what people believe? Well, maybe or maybe not. I'm sure you can think of your own examples without me annoying the moderators.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#260

Post by qingcharles »

jillyboel wrote: post #247
singpolyma3 wrote: post #168

Earlier quoted context omitted.

As if courts care about any of that. They'll just ask the witness "did you send this email"

Which is why you say "No". Then when they try to prove that you did in fact send it, this comes up.

Well, if you did send it then you just perjured yourself, so you better hope you don't get caught :)
Post reply on HN