3 ms·

I am not a lawyer, but I do not believe that DKIM provides repudiation specific to an individual. DKIM provides evidence that email originated on an email prov

I am not a lawyer, but I do not believe that DKIM provides repudiation specific to an individual. DKIM provides evidence that email originated on an email provider. The users neither own nor control the server and user accounts get compromised all the time as well as fake accounts created all the time. Google battles this daily. DKIM might be one piece of information, used in combination with a client IP address and some method of proving who was at that client IP address at the time, but I do not believe that DKIM could stand on its own. For example, I have servers that DKIM sign emails. If a person uses my servers to send a death threat, the FBI is going to want web access logs and smtp logs.

beagle3 6y ago
It is even weaker than that. DKIM keys themselves can be stolen - most servers don’t store them in HSMs (and HSMs are also not infallible). Or factored - Debian had a bug 12 years ago that caused weak SSH keys, a similar thing could happen to DKIM key generation (or has happened, but not yet discovered). Some study showed many RSA keys in the wild had a common factor. A weakness of this family might be discovered with DKIM keys. It is supporting circumstantial evidence, not proof of identity.
- Natanael_L 6y ago
  Many DKIM keys uses outdated key generation defaults with 512 bit RSA keys. Google used to have such weak DKIM keys too in ~2012.