Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking a 512-bit DKIM key for less than $8 in the cloud

dmarcchecker.app

Post reply on HN
Print view View original

81–90 of 433 posts

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#81

Post by infogulch »

phkahler wrote: post #77
matthewdgreen wrote: post #39

Earlier quoted context omitted.

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were…

What's the problem with verifiable email? You can just delete old emails (if gmail or whoever archives them that's another problem). Most people probably operate under the assumption that email is verifiable in some way anyway. If you receive malicious email, isn't it a good thing to be able to verify where it came from? Doesn't that benefit senders and receivers alike? Or is this a case of "I want to verify you, but…

It's more "I want you to be able to verify I sent an email to you, but I don't want you to be able to prove to a third party that I sent it."

The fact that this is possible is some cryptography black magic.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#82

Post by wolrah »

croes wrote: post #16
Havoc wrote: post #6

Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…

> Even simple things like forcing TLS 1.3 instead of 1.2 from client side breaks things...including hn site. That’s the reason, it breaks things, and some of them are important and can’t simply be updated.

> That’s the reason, it breaks things, and some of them are important and can’t simply be updated.

IMO this is not a valid excuse.

If it's exposed to the internet it needs to be able to be updated with relative ease to respond to a changing threat landscape. Especially if it's "important". If it cannot be then it is already broken and needs to be fixed. Whether that fix is doing a hard upgrade to get to the point that future upgrades can be easier, entirely replacing the component, or taking the thing offline to a private non-Internet network depends on the situation, but "we aren't going to change, the rest of the internet should conform to us" has never been a reasonable response.

This is particularly true in the contexts of public mail servers where DKIM matters and anything involving public use of TLS. The rest of the internet should not care if your company refuses to update their mail servers or replace their garbage TLS interception middleboxes. We should be happy to cause problems for such organizations.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#83

Post by DarkmSparks »

"as RSA keys shorter than 1,024 bits are considered insecure, and their use in DKIM has been deprecated since the introduction of RFC 8301 in 2018."

LOL. One of my favourite internet flame wars was circa 2007 (in and around discussing the incoming financial crises) and we got talking about encryption and how none of it actually "works".

Particularly vile troll, and iirc also owner of the site bet me $50,000 I couldn't reverse the 512 RSA key he posted (created by openssl).

He got the factorisation less than an hour after he made the post.

Strangely, the entire site disappeared pretty quickly after that (and it's not on wayback machine).

given where the math guys are now with GNFS I'm not sure I would trust 8192 bit RSA in 2024, 2018 for dropping 512 bit was already more than a decade late.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#84

Post by colmmacc »

phoe-krk wrote: post #65
colmmacc wrote: post #61

Breaking a 512-bit key for a good demonstration is very valuable security research, even if it's been done before. It's also legit to call out "Hey, here's a list of folks still using 512 bit, they should move off." ... but for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable. IANAL but it might even be criminal. Just seems a bit unnecessary.

> for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable They've contacted the company with the vulnerability and resolved it before publishing the article - search the original article for the substring "now no longer available". Usually, you demonstrate that an online system is vulnerable by exploiting that vulnerability in good faith, documenting the research, and sub…

I read the article, and I don't think it changes it. If you crack someone's key, they might be well within their rights to pursue a criminal prosecution. Of course it would also have a Streisand effect and there's reasons not to, but I personally wouldn't allow or recommend a security researcher to do it. It's needlessly risky.

In general, subverting security and privacy controls tends to be illegal in most jurisdictions. Best case is when you have clear permission or consent to do some testing. Absent that there's a general consensus that good faith searching for vulnerabilities is ok, as long as you report findings early and squarely. But if you go on to actually abuse the vulnerability to spy on users, look at data etc ... you've crossed a line. For me, cracking a key is much more like that second case. Now you have a secret that can be used for impersonation and decryption. That's not something I'd want to be in possession of without permission.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#85

Post by colmmacc »

mmastrac wrote: post #69
colmmacc wrote: post #61

Breaking a 512-bit key for a good demonstration is very valuable security research, even if it's been done before. It's also legit to call out "Hey, here's a list of folks still using 512 bit, they should move off." ... but for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable. IANAL but it might even be criminal. Just seems a bit unnecessary.

Breaking a key isn't criminal. It's just math. Sending emails that would constitute fraud or a violation of another jurisdictional law, relying on that math, is illegal. But again -- it's not the math, it's the action and intent. Pointing out that someone is doing something stupid is also not illegal, though they make try to make your life painful for doing so.

Secrets themselves are often regarded as sensitive information, and often also categorized in the highest classifications for information protection. This stuff isn't just a game, and in my experience it's not how law enforcement authorities or courts see things.

Just as if you made a copy of the physical key for a business's real-world premises, you could well find yourself in trouble. Even if you never "use" it.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#86

Post by masom »

halfmatthalfcat wrote: post #55
qwertox wrote: post #24

Because we need that compute for our React frameworks.

[flagged]

Simple economics; who pays for the servers and who pays for the front-end execution?

Front-ends are essentially free distributed computing resources while the backends need to be paid for.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#87

Post by GuB-42 »

zelphirkalt wrote: post #4

Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.

RSA-1024 seems to be about 8 million times better than RSA-512, so cracking that would be $64 million in compute.

Not NSA-proof, but should be more than enough to keep spammers out, especially considering that DKIM is just one layer of protection.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#89

Post by colmmacc »

michaelmior wrote: post #64
colmmacc wrote: post #61

Breaking a 512-bit key for a good demonstration is very valuable security research, even if it's been done before. It's also legit to call out "Hey, here's a list of folks still using 512 bit, they should move off." ... but for me, actually cracking a real-world in-use key crosses an ethical line that makes me uncomfortable. IANAL but it might even be criminal. Just seems a bit unnecessary.

I am also not a lawyer, but I would suspect it's not criminal to crack a real-world in-use key if you do so using only publicly available information and you don't actually do anything with the result.

Let's say you local coffee shop is featured in a local news piece and the blithe owner happened to get photographed holding the store key. That's now easy to clone from public information. Would you be comfortable actually doing it? Reporting the issue is fine - "Hey you should rekey your locks!".

Actually making a clone of the key, and then showing "hey it fits" will get you more traction more quickly ... but there's also plenty of Police Departments who might well arrest you for that.

Re: Cracking a 512-bit DKIM key for less than $8 in the cloud

#90

Post by jagged-chisel »

CodesInChaos wrote: post #73
GTP wrote: post #47

Earlier quoted context omitted.

Isn't deniability at odds with DKIM's goal? What would be the point of setting DKIM then? Sure, it helps with spam scores. But most companies rely on a major email provider to send emails, so maybe they wouldn't have deliverability issues anyway?

When using deniable authentication (e.g. Diffie-Hellman plus a MAC), the recipient can verify that the email came from the sender. But they can't prove to a third party that the email came from the sender, and wasn't forged by the recipient.

Mallory sends a message, forged as if from Alice, to Bob. How can Bob determine that it came from Alice and wasn’t forged by Mallory?
Post reply on HN