Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

381–390 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#381

Post by littlestymaar »

DarkmSparks wrote: post #376
littlestymaar wrote: post #361

Earlier quoted context omitted.

I'm charitably sharing this to you: https://news.ycombinator.com/item?id=42645216 because someone actually interested in learning things asked the right question. May you sleep less ignorant tonight. > Further I'll note you sound exactly like the kind of person insisting diffie hillman was a good key exchange mechanism prior to Snowdens disclosures. good luck with that. Before or after Snowden, Diffie-Hellman (it's M…

->Before or after Snowden, Diffie-Hellman (it's Martin Hellman with an “e”) is a good key exchange mechanism! Meanwhile, ~10 years ago https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logs in that group in about a minute. We find that 82% of vulnerable servers use a single 512-bit group, allowing us to compromise c…

512 was known to be too low for a looong time, why do you think it was the export-grade security?

1024 being at risk against state-level adversaries isn't shocking to anyone, but there's a significant gap between this and costing $64, and this gap is much bigger than 10 years of Moore's Law (NSA had much more than 32*$64 of available compute ;).

You're making grandiose claims and there's nothing that holds in your reasoning, it really feels like I'm discussing physics with a flat-earther…

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#382

Post by dang »

croemer wrote: post #350
dang wrote: post #334

Earlier quoted context omitted.

"How we X'd a Y" is a linkbait trope. We edited that in accordance with the site guidelines: " Please use the original title, unless it is misleading or linkbait ". https://news.ycombinator.com/newsguidelines.html

Thanks for clarifying. Interestingly, in the guidelines, there's an example of where you _add_ "How" instead of removing it: "E.g. translate '10 Ways To Do X' to 'How To Do X'". That tripped me.

We don't remove "how" from "how to". There are a bunch of exceptions like that. It's all pretty simplistic though.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#383

Post by rstuart4133 »

tptacek wrote: post #265
rstuart4133 wrote: post #258

Earlier quoted context omitted.

Repudiation doesn't work if the receive discards the email if it isn't signed, or marks it as DKIM validated when it is received. Many receivers using independent email providers like gmail, so the sender has no control over whether it happens or not. Both practices are common today, so it likely it does happen. Rotating the key does make the claim "I have proof he sent it" a litter weaker, as it's no longer as easy…

Rotating the key and publishing the private key destroys the ability of an after-the-fact attacker (someone who pilfers older mails out of your inbox) to prove they obtained a real email. It's not an "only a little" thing; it's categorical.

Yes, it's a pretty good way of proving the server sent the email. That's all it proves. If the email came from gmail.com, it's up to Google to prove the person in the From: address composed the email. The signature can't prove that. Nonetheless almost everyone will accept that is what happened.

If Gmail received the email, it's likely they simply drop email with no or bad DKIM signatures. So if it's in your gmail inbox but a has signature that doesn't check out, to be categorically certain it was signed you would have to ask Google. But it's the same deal as the From: address - almost everyone is going to assume it was validly signed because that's gmail's policy.

TL/DR, I think your wrong. Rotating the key only weakens the proof slightly. The only thing that is destroyed is the cryptographic proof, but only in a fanatical cryptographers world is that the only form of acceptable proof. That fanatical cryptographer is wrong of course. Things outside of the mathematical certainty also matter. The rubber hose joke is funny, and the butt of that joke is fanatical cryptographers making that very assumption.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#384

Post by tptacek »

rstuart4133 wrote: post #383
tptacek wrote: post #265

Earlier quoted context omitted.

Rotating the key and publishing the private key destroys the ability of an after-the-fact attacker (someone who pilfers older mails out of your inbox) to prove they obtained a real email. It's not an "only a little" thing; it's categorical.

Yes, it's a pretty good way of proving the server sent the email. That's all it proves. If the email came from gmail.com, it's up to Google to prove the person in the From: address composed the email. The signature can't prove that. Nonetheless almost everyone will accept that is what happened. If Gmail received the email, it's likely they simply drop email with no or bad DKIM signatures. So if it's in your gmail inb…

I really don't follow what you're trying to say here. The point is that the durable verifiable signature has no value to users, but lots of value to attackers; in other words: it only has value to attackers. People are confused because in a formal analysis, journalists getting stories from leaked mail spools are attackers; they are a thing secure messengers are designed to thwart.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#385

Post by littlestymaar »

DarkmSparks wrote: post #374
littlestymaar wrote: post #359

Earlier quoted context omitted.

1km² aka 1,000,000m², note how the resulting units aren't km and m but square kilometers and square meters. > What can you square then? In that case it's the number of operations (which is unitless) that must be squared and then multiplied by the cost of each operation. For instance (figures are completely made up for illustration purpose) if one individual operation costs 0.1 cent, and you have 8000 ops for the fact…

the search space is p1×p2 = cost therefore (p1^2) x (p2^2) = (p1xp2)^2 =cost^2 and gnfs search cost increases in cost by (roughly) the square of the number of bits.

I'll keep trying to explain it to you: you cannot take the square of a price.

If my Yuan exchange rate example didn't convince you, let's have a few thoughts experiments:

- let say you can do can do some amount of work for less than $1 (maybe even factoring a 512 bits number) let's call that amount of work X, and you do it for say $0.9. Do you think you can do X² work for price^2, which is $0.81 ? Yes, much more work for less than the price of doing X, isn't that magical?

- a hard drive with 1TB of storage costs $40. Do you think you can have 1 Yottabyte (10^12 squared is 10^24) of storage for just $1600?

There's a reason to all these paradoxes, it simply makes no sense to take the square of a sum of money, because you can't pay it in square dollars.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#387

Post by tptacek »

colmmacc wrote: post #369
tptacek wrote: post #302

Earlier quoted context omitted.

I don't think there's a way to make it criminal, any more than publishing a vulnerability that got you code execution on their servers could be. Actually exploiting it, of course, would be.

I think many in cryptography would see cracking a key as a precondition to "actually exploiting it" ... because you've only gotten a cryptographic secret, not "actual data". But I think many others, and many in law enforcement, will see cracking a key as "actually exploiting it". You've exploited the cracking vulnerability to target a particular key, is how they'll see it. Law enforcement also have a natural incentiv…

The US law most at play in criminal prosecution of computer usage is CFAA, and a clear CFAA predicate is intentional access to a protected computer (18 USC 1030(a)(2)). This distinction is what makes vulnerability research on things like Chrome vulnerabilities generally safe (as long as you don't knowingly spirit exploits to people who are actually attacking people), while vulnerability research on other people's websites (looking for SQLI and SSRF) is risky.

The CFAA has a clause about "trafficing in passwords or similar information" (18 USC 1030(a)(6)), but the mental state requirements are very high: that trafficking has to be knowing and with intent to defraud (that intent will be something prosecutors will have to prove at trial).

There might be some state law somewhere that makes this risky, but virtually every hacking prosecution in the US anyone has heard of happens under CFAA. I'm not a lawyer, but I've spent a lot of time with CFAA, and I think cracking DKIM keys is pretty safe.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#388

Post by inopinatus »

speerer wrote: post #357
singpolyma3 wrote: post #322

Earlier quoted context omitted.

I'd say it refutes the counter-example. The court doesn't care about DKIM, they care about witness testimony. DKIM might have convinced the witness sometimes though.

Courts typically do not care as much about what an expert witness thinks, as rather why they think it - and whether their reasons hold up enough that the conclusions they support should be accepted.

That is not quite correct. A court is undoubtedly interested in what an expert witness has to say.

It is the lawyers appearing before the court that may attempt to play the person not the ball, by variously undermining or bolstering their standing as an expert at all.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#389

Post by Bluestein »

Groxx wrote: post #377
ryan-c wrote: post #238

Earlier quoted context omitted.

I've been doing this since around 2018, and have seen a few others implement it. https://rya.nc/dkim-privates.html

/me skims, reaches footnotes Sometimes you've just gotta love those auto-shortened URLs: security.googleblog.com/2013/12/internet-wide-efforts-to-fight-email.html Hopefully one day we'll win the fight.

Google Wave, represent!

PS. Of course y'all young'uns won't remember ...

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#390

Post by DarkmSparks »

littlestymaar wrote: post #385
DarkmSparks wrote: post #374

Earlier quoted context omitted.

the search space is p1×p2 = cost therefore (p1^2) x (p2^2) = (p1xp2)^2 =cost^2 and gnfs search cost increases in cost by (roughly) the square of the number of bits.

I'll keep trying to explain it to you: you cannot take the square of a price. If my Yuan exchange rate example didn't convince you, let's have a few thoughts experiments: - let say you can do can do some amount of work for less than $1 (maybe even factoring a 512 bits number) let's call that amount of work X, and you do it for say $0.9. Do you think you can do X² work for price^2, which is $0.81 ? Yes, much more work…

every time you double the number of bits, you increase the search space by the square of what came before

2^16 = 65536

2^32 = 4294967296

4294967296/65536 = 65536

so if a search space of 65536 costs you $8, then a search space of 4294967296 = 65536 x 65536 = 8 x 8 = 8^2 = $64

2^64 = 1.844674e+19

1.844674e+19/4294967296 = 4294967296

so a search space of 1.844674e+19 = 4294967296 x 4294967296 = 65536 x 65536 x 65536 x 65536 = 8 x 8 x 8 x 8 = 8^2^2 = 8^4 = $4096

where here $8 is the cost of finding (or not) 1 number in a haystack of 2^512 numbers, and the rest is identical.

Post reply on HN