Reminds me of factoring 512-bit RSA signing keys used on Ti calculators in 2009: https://en.wikipedia.org/wiki/Texas_Instruments_signing_key_...
Cracking a 512-bit DKIM key for less than $8 in the cloud
321–330 of 433 posts
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#322Earlier quoted context omitted.
That would be a counter-counterexample, wouldn't it?
Nah, it supports the counter-example, so it's a counter-example example.
I'd say it refutes the counter-example. The court doesn't care about DKIM, they care about witness testimony.
DKIM might have convinced the witness sometimes though.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#323Earlier quoted context omitted.
If you’re under Rule 26 discovery or disclosure requirements, it absolutely might be my business whether emails in your client are valid, but I suppose you could classify opposing counsel as an “attacker,” so you’re not wrong.
Note, just to rub this in: you don't even get the verification you're looking for, because DKIM verifies domains and not users.
I get the verification the email actually came from the domain (i.e., someone, who has the credentials of an insider) vs. an email that was totally spoofed, from the outside, without any creds of the purported sender org. (Right?)
Hands on keyboard? You're right, absolutely not. But I can learn something useful via DKIM nevertheless.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#324Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#325Earlier quoted context omitted.
Haha, definitely not true outside of the US and Western Europe. Most of Asia (and probably Africa) uses phone #.
Thats because those are mostly developing countries which were late to the internet party, and are accessed mainly through mobile. Phone # could well be a replacement for email globally in the future, once all the younger generation grow up and rule the world.
Users in those countries already vastly outnumber users in other countries. And are growing much, much faster too.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#326Earlier quoted context omitted.
> More importantly: latent verifiable secure DKIM signatures on archived emails offer no value to users; they literally only have real-world value to attackers. I don't think this is quite true. First of all, this is not only valuable to attackers, it's also valuable in a court of law to establish the truth of what happened. Secondly, it can be valuable to me to be able to prove that you sent me an email, even if you…
Those are cases where DKIM is working against the user! I get that we can come up with cases where we're glad some hapless user is undone by DKIM, but when we're discussing messaging security, we generally take the side of the hapless user, not the courts and tort lawyers!
An email exchange has two users: one is the sender, the other the receiver. As the receiver, having proof that I received an email from you is potentially a feature, not a problem.
More generally, authenticated communication has a long history of being considered a useful thing for society. Physical mail includes delivery confirmations where the receiver must sign for the receipt, proving to anyone that they did receive the letter. People would often add hard-to-forge personal seals to letters in even older days, that could prove to anyone that they were the ones who sent that document. And even common letters were usually signed rather, even when typewritten, again making it hard to later repudiate.
While I absolutely see the value in making it possible to securely send repudiatable email in some specific circumstances, I think having non-repudiatable email as the default is a net benefit to society, and has been the de facto standard for at least a few hundred years before email ever came along.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#327Earlier quoted context omitted.
Those are cases where DKIM is working against the user! I get that we can come up with cases where we're glad some hapless user is undone by DKIM, but when we're discussing messaging security, we generally take the side of the hapless user, not the courts and tort lawyers!
An email exchange has two users: one is the sender, the other the receiver. As the receiver, having proof that I received an email from you is potentially a feature, not a problem. More generally, authenticated communication has a long history of being considered a useful thing for society. Physical mail includes delivery confirmations where the receiver must sign for the receipt, proving to anyone that they did rece…
This is the classic argument in favor of verifiable DKIM signatures: because it benefits the consumers of hacked mail spools. Consider that as a security engineering decision, enabling that use case is a bad thing.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#328Earlier quoted context omitted.
> "Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware." So we went to a few weeks to 8h in 14 years give or take
86 hours. 8 dollars. I wonder how scalable it is. They only used: > We chose a server with 8 dedicated vCPUs (AMD EPYC 7003 series) and 32 GB of RAM from Hetzner Not very beefy really. Beating this time is easily in range of, what, millions of people high end gaming machines?
> 86 hours
I stand corrected
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#329"as RSA keys shorter than 1,024 bits are considered insecure, and their use in DKIM has been deprecated since the introduction of RFC 8301 in 2018." LOL. One of my favourite internet flame wars was circa 2007 (in and around discussing the incoming financial crises) and we got talking about encryption and how none of it actually "works". Particularly vile troll, and iirc also owner of the site bet me $50,000 I couldn'…
> not sure I would trust 8192 bit RSA in 2024 Do you have any proof/quote for that? Some pretty knowledgeable and well-known people in this thread 2048 bit RSA is quite safe with current capabilities[1] 1: https://news.ycombinator.com/item?id=42635066
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#330Earlier quoted context omitted.
Oh, I wasn't aware of the end of the challenge. But 1024 was definitely not broken by then, at least not by brute force.
none of it is "brute force", GNFS is a process that rapidly excludes numbers from the search space that cannot be the answer, in principle similar to the way they broke enigma. numberphile has a great video on that one https://www.youtube.com/watch?v=V4V2bpZlqx8 Also, taking the OP as a "worse case", afaik: 512bit = $8 so 1024 = 8^2 = $64 2048 = 8^2^2 = $4,096 4096 = 8^2^2 = $16,777,216 noting $8 for 512 seems very e…
Come on! Not only your math is ridiculous (you can't just square amounts of money, just consider how it would work if you changed currency: $8 is 1260¥, squares it makes it 1587000¥ which is $10k != $64) but believing that RSA-2048 is factorizable in $4k is hilarious.
> none of it is "brute force"
It's not exhaustive search like it would be for symmetric encryption, but it's still somewhat brute-force (especially since RSA keys are inflated in size compared to symmetric encryption to accommodate for their vulnerabilities), put more clearly what I meant was “not without theoretical breakthrough unknown to the public”.
BTW, it's not a very good idea to lecture people with actual crypto knowledge (even though mine is quite rusty now for I have not done any serious stuff for 15 years) when your own comes from ill-understood YouTube vulgarization videos.