Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

261–270 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#261

Post by qingcharles »

reaperman wrote: post #228
lupusreal wrote: post #74

Earlier quoted context omitted.

Meanwhile in the real world, screenshots of emails without any cryptographic authentication at all are good enough to send people to prison.

Only if the defendant doesn't challenge the evidence. If I'm the defendant and I know I sent those emails, I'm not going to challenge the screenshot. If I know I did not send those emails, then I'll do my best to pay for forensic analysts to generate evidence to exonerate me.

Experts are expensive. Most defendants never get them.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#262

Post by rstuart4133 »

matthewdgreen wrote: post #39
jgrahamc wrote: post #21

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

From the blog:

> The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.

Maybe that was true a while ago, but it becoming much less true now. Most people and organisations outsource the email handling to the likes of Google and Microsoft. They tend to reject email that isn't DKIM signed, and add a "DKIM validated" header to those that are. "Tend" is probably too weak a word now - email that isn't signed isn't likely to be delivered.

So the mostly likely scenario now is "someone steaks email that can no longer be DKIM validated, but it is possible prove it was DKIM validated when it was received". If that's true rotating keys doesn't help.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#263

Post by daneel_w »

throw0101c wrote: post #205
daneel_w wrote: post #174

Earlier quoted context omitted.

There's no good reason at all, which is why RSA-3072 is the rarely seen "oddball".

> There's no good reason at all Operations per second? * https://wiki.strongswan.org/projects/strongswan/wiki/PublicK... Running MacPorts-installed `openssl speed rsa` on an Apple M4 (non-Pro): version: 3.4.0 built on: Tue Dec 3 14:33:57 2024 UTC options: bn(64,64) compiler: /usr/bin/clang -fPIC -arch arm64 -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX15.sdk -arch arm64 -isysroot /Library/Develop…

These are contrived benchmarks at the extreme end of things. In real world usage the difference is drowned-out by the delays of so many other things happening in order to complete a handshake and key exchange. The mildly higher performance of RSA 3072 versus RSA 4096 wasn't even a big bonus during the CPU performances we had 15 years ago.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#264

Post by tptacek »

rstuart4133 wrote: post #256
tptacek wrote: post #196

Earlier quoted context omitted.

No. DKIM is meant to apply to emails in transit; it is part of the transaction of exchanging emails. But DKIM signatures are verifiable long after that transaction has completed. That was not an intended feature of DKIM, and it's a grave privacy violation. To satisfy DKIM's design goal, you only need a "current" DKIM key that is secure for a window of time. When that window of time passes, you rotate the secret and p…

> it's a grave privacy violation. I'm missing something here. DKIM mostly proves an email from person@from.me was sent by a server @from.me controls. There is also a bloody great audit trail inside of the email with together with SPF can do a pretty good job of proving the same thing. I'm struggling to see how an email sent to me, that presumably was always intended to be readable by me could suddenly become a privac…

It's nobody else's business whether the emails in your inbox are valid or not, and that's basically all non-deniable DKIM signatures do: durable secure verifiable DKIM signatures are "security feature" with real-world value exclusively for attackers.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#265

Post by tptacek »

rstuart4133 wrote: post #258
ryan-c wrote: post #239

Earlier quoted context omitted.

Repudiation is the goal.

Repudiation doesn't work if the receive discards the email if it isn't signed, or marks it as DKIM validated when it is received. Many receivers using independent email providers like gmail, so the sender has no control over whether it happens or not. Both practices are common today, so it likely it does happen. Rotating the key does make the claim "I have proof he sent it" a litter weaker, as it's no longer as easy…

Rotating the key and publishing the private key destroys the ability of an after-the-fact attacker (someone who pilfers older mails out of your inbox) to prove they obtained a real email. It's not an "only a little" thing; it's categorical.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#266

Post by AlotOfReading »

sedatk wrote: post #253
tptacek wrote: post #95

Earlier quoted context omitted.

We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).

People might be assuming that 2048-bits is only twice as strong as 1024-bits, but it's in fact a billion times better. (corrected, thanks!)

That would be true if RSA scaled proportionally with the number of bits, but the exponent involved is much lower than 1. 1024->2048 gives you around the same difficulty as adding 30 bits to a symmetric key.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#267

Post by daneel_w »

throw0101c wrote: post #35
daneel_w wrote: post #17

Earlier quoted context omitted.

Probably because RSA 2048 is not yet broken, and once there we still have RSA 4096 to lean back on which is since quite some time the most common key size for most things using RSA (DKIM being one of the exceptions). In the context of DKIM we're waiting for Ed25519 to reach major adoption, which will solve a lot of annoyances for everyone.

> Probably because RSA 2048 is not yet broken […] 3072 has been recommended by various parties for a few years now: * https://www.keylength.com

Nobody is recommending RSA-3072 per se. The recommendation if wanting to stick with RSA is to move beyond RSA-2048, and the world at large jumped all the way to RSA-4096 long ago.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#268

Post by tptacek »

rstuart4133 wrote: post #262
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

From the blog: > The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves. Maybe that was true a while ago, but it becoming much less true now. Most people and organisations outsource the email handling to the likes of Google and Microsoft. They tend to reject email that isn't DKIM signed, and add a "DKIM validated" header to those that are. "Tend" is probably too weak a word n…

The idea isn't to stop Google from signing and validating DKIM. It's that the major players who do DKIM should rotate and publish their keys, so that at any given instant their current DKIM key is only valid for N hours, and after that it's public, so anyone can forge backdated messages.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#269

Post by dusted »

If you want to try something fun:

Provision a 4096-bit DKIM key.

Every online DKIM/SPF checker will say all is good when looking at your DNS.

They will also fail any test email you send, with more or less excellent descriptions such as:

STATUS: Fail

DKIM: Pass

SPF: Pass

There's this fun thing that, apparently:

It's permitted and valid to use keys larger than 2048 bits in your DKIM entry.

It is not, however, required to process keys larger than 2048 bits.

This cost me some hair to learn the hard way.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#270

Post by tptacek »

SmellTheGlove wrote: post #245
jabart wrote: post #129

Earlier quoted context omitted.

Doing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.

Right. There’s generally going to be other evidence. Rotating the DKIM isn’t going to save anyone relying on the shaggy defense.

This isn't about evidence. In a court case, discovery and court orders can authenticate email messages even if providers publish their keys; the provider will have a record of having verified the email when it was received. But ATO attackers will not have access to those records.
Post reply on HN