12 ms·
DKIM: Rotate and publish your keys
- sylware 3y agoSPF is enough (and it is built-in with plain no-DNS SMTP servers).
- pawal 3y agoNot if you want to deliver e-mail to Google, they recently added this as a requirement.
- sirius87 3y agoYep. I have a catch-all email address for a domain that forwards all mail to Gmail and that stopped working somewhere in the Jul-Aug timeframe. Had to set up DomainKeys to fix the issue.
- sylware 3y agoStill working fine here. And about to switch to no-DNS emails (alice@[x.x.x.x] and bob@[IPv6:...] in the SMTP specs)
- Avamander 3y agoHighly unlikely you'd be able to deliver any mail to any significant operator after that switch.
- sylware 3y agoI did run a few months in no-DNS email mode without issues, but was 2-3 years ago. I know regulation and lawyers may be needed if significant conflicts happen with unreasonable system administrators. It is critically important to keep the emails flowing independently from the DNS mafia/racket, like the web, but I guess we all very know that here on HN.
- tmpX7dMeXU 3y agoCertainly not.
- 0x073 3y agoWorks great with email address forwarding.
- Avamander 3y agoSPF is so obsolete that DMARC is going to get an option to disable evaluating it altogether.
- tamimio 3y agoIt’s not, SPF won’t survive a forwarded email. Make sure to use DKIM and DMARC policy to properly mitigate any authenticity issues.
- tkfu 3y agoI have a big soft spot in my heart for idealistic crypto stuff like this. Everything the author argues is true...but there's no way in hell commercial email providers would actually publish their private keys. The only way it would be in their interest to make it easy to forge old emails would be if a substantial portion of users demanded it, and that's never going to happen.
- tjoff 3y agoIf this is not done, your emails are “non-repudiable”, meaning that if they are leaked, anyone (eg, journalists, haters) can verify that they are authentic, and prove that to others. This is not desirable (for you). Not convinced, the bigger problem today seems to be that someone claims that you sent something you didn't and if you do the above you can't disprove that. You could sign your emails, but then the whole point of publishing the private keys is negated anyway...
- gorgoiler 3y agoDouble DKIM? The first signature for your future proof-of-authorship needs and the second for regular DKIM mechanisms to accept your email? The first key isn’t ever published but you keep it if you need to prove your email was written by you. The second key is rotated regularly with the private key published so that always have the ability to claim “I didn’t write that”.
- A1kmm 3y agoBut then you could just have a third key to use in place of the first for anything you think you might want to get out of later. You could have a mechanism to prove two emails are signed with the same key, without revealing the public key (e.g. using a zero-knowledge technique like zk-SNARKs) - but that might then be functionally equivalent to just revealing the key in terms of non-repudiation anyway.
- remram 3y agoThe comment above asked for a way to prove it was not written by you.
- nulbyte 3y ago> You could sign your emails, but then the whole point of publishing the private keys is negated anyway... Not really. The point is to deliver emails. Once it's delivered, it doesn't matter as much.
- tjoff 3y ago
- compsciphd 3y agoThis came up with the hunter biden laptop, DKIM doesn't really validate that you sent an email, but that an email was sent through that server at some point in time when said signing key was still being used. i.e. I demonstrated to others that I could have a DKIM signed email sent through gmail that was from a spoofed from: and it passed all DKIM tests (i.e. telnet gmail smtp server 25 (well with ssl, so openssl connect or something). smtp auth and do the standard MAIL FROM "SoSo <so@so> RCPT TO so@so data...... and it will look like a legit mail sent from SoSo. DKIM's job isn't to protect against that.
- sschueller 3y agoWasn't it also Hillary Clinton's emails that had DKIM and they denied that they wrote any of them? If that were the case it would mean someone has full access to that email system for years and sent all those emails through it.
- viraptor 3y agoLink? From what I remember, the details in that case where handed over in cooperation. Was there anything actually denied? There was only the issue around retention/deletion of emails, but even that didn't include a tech proof AFAIK.
- talent_deprived 3y agoAgreed, they may be recalling the Podesta emails: https://en.wikipedia.org/wiki/Podesta_emails https://en.wikipedia.org/wiki/Podesta_emails
- logifail 3y agoQ: If 2FA is enabled on a Google account, does SMTP AUTH still work? I've just tested this, I generated a new app password in my Google Account and used that to send Gmail from Python. Works fine when sending "from: <me@gmail>" with the app password, yet I can't change the sender since the SMTP auth then fails "5.7.8 Username and Password not accepted. Learn more at https://support.google.com/mail/?p=BadCredentials https://support.google.com/mail/?p=BadCredentials"
- throwawaaarrgh 3y agoPublish your ssh private keys!
- op00to 3y agoMy voice is my passport!
- simplereally 3y agoPublish your private keys and be considered responsible for what is signed with them, simple really :) I am not a fan of blockchains but this is a rare case where they could be used to prove that the message is authentic by publishing the hash of the message (including the signature) in it. If the DKIM private key was published after the message was added to the blockchain then the message was clearly legitimate.
- rlpb 3y agoNo need of "blockchain" for that. Just do a hash drop to any publicly archived place, or use a timestamping service.
- remram 3y ago> Publish your private keys and be considered responsible for what is signed with them, simple really What makes you think that?
- simplereally 3y agoI am not thinking of anything, I am simply proposing a solution as I fear that DKIM rotation might end up being used for gaslighting.
- remram 3y agoWhat makes you fear that? This is a discussion forum, you can't state thing and expect that no one will ask why.
- simplereally 3y agoI never had such an expectation.
- londons_explore 3y agoIs this actually a problem in practice? How many people have presented forged emails as real without a DKIM signature, and had the press say "nah, we're not going to report on that because DKIM is missing"?
- vintermann 3y agoThey absolutely will assume something was fake if it's embarrassing and they think it can't be proved. Most of them don't know about DKIM signatures, though. A lot of wikileaks mails were verified with DKIM, and as I recall some of the people sending them initially denied it.
- matthewdgreen 3y agoHere is the tool the Associated Press uses to check DKIM signatures [1], and here is Wikileaks' page on DKIM [2]. DKIM is routinely used to verify emails in cases where the evidence chain back to the source is unclear. I was personally involved in a forensic effort to verify DKIM signatures on the Hunter Biden laptop [3]. [1] https://github.com/associatedpress/verify-dkim https://github.com/associatedpress/verify-dkim [2] https://wikileaks.org/DKIM-Verification.html https://wikileaks.org/DKIM-Verification.html [3] https://www.washingtonpost.com/technology/2022/03/30/hunter-biden-laptop-data-examined/ https://www.washingtonpost.com/technology/2022/03/30/hunter-...
- LeonM 3y agoSo for work I consult on email security and every time this article pops up I get texts from everybody asking for my opinion. So here we go. Disclaimer: opinions are my own. A DKIM signature does not prove that an individual sent the email, the key is not personal. A DKIM signature proves that the sending service is a delegated sender for the domain. Meaning that a correct DKIM signature proves that the part after the '@' symbol in the sender address is authentic. Not the part before that. If you want to use a personal signature, you can use S/MIME. If you are a delegated sender for the domain, then you can use any sender name (the part before the '@' in the sender email address). This is how email works. The password that is typically required to authenticate with your outbound SMTP service if only enforced by that host. So an email with sender address jane@example.com that is DKIM signed only proves that the email was send by a host that is a allowed to send email on behalf of example.com. It does not prove in any way that the email was sent by Jane. Also, as others have mentioned, none of the email service providers will give you the private keys. I'd like to add that in most cases this won't even be possible, due to the use of HSMs. So the proposed scheme would only work in a situation where you are owner of the DKIM key (thus in practice where you are the owner of the host sending the email), and where you also own the domain. It is trivial for a prosecutor to prove the owner of the domain, or the owner of the host that used the DKIM key. No amount of publishing keys will help you deny that ownership. In my opinion it makes no sense in signing your email (whether it is S/MIME or DKIM) to prove that the email is authentic, and then complaining that there is no way to deny that the email is authentic once stuff goes bad.
- proto_lambda 3y ago> It is trivial for a prosecutor to prove the owner of the domain, or the owner of the host that used the DKIM key The point of publishing the keys is that _anyone_ can then sign messages, making "ownership of the domain" a meaningless factor, no matter how much you can prove it.
- djbusby 3y agoSounds like spammer could use the key then too? Send DKIM signed message from my domain?
- WesolyKubeczek 3y agoAwww yisss, publish all the private keys, let’s have a DKIM-verified phishing bonanza while we are at it, too!
- KirillPanov 3y agoCaptcha Check Hello, you've been (semi-randomly) selected to take a CAPTCHA to validate your requests. Please complete it below and hit the button!
- pacija 3y agoSPF says which IP adresses are authorized to send email for a domain. DKIM should increase confidence that email is sent by authorized service on servers with those IP addresses (eg. Postfix) as opposed to unauthorized ones (eg. telnet). Finally, DMARC instructs receiving servers how to act on receiving email for a domain regarding validity of SPF and DKIM. It is up to receiving servers to respect this instruction or not. None of the above has anything to do with particular email message authenticity. Mechanisms for email authenticity, or additionally confidentiality, are S/MIME and PGP, where user controls the key, and it is up to them to make sure it doesn't leak. I am providing email service to close to thousand users on dozens of domains over the course of fifteen years. The article does not make much sense to me from either postmaster's or mail user's point of view.
- proto_lambda 3y ago> None of the above has anything to do with particular email message authenticity. Only if you're on a shared email hoster. If you're the only one that has access to the mail server's signing keys, it's gonna be real hard to convince anyone that someone else signed that email.
- deleted 3y ago[deleted]
- scandox 3y agoPresumably there is a transitional period during which the new DKIM key becomes active and the old inactive. Will some legitimate mails fail verification during that period?
- gorgoiler 3y agoYou can have multiple keys at once: serve the old keys while announcing and using a new key.
- alphager 3y agoNo. You can have multiple DKIM DNS records (each identified by an id called selector). Each DKIM signature includes the selector. When you change keys, you create a new DNS entry with a new selector, then change the settings of the mailserver. New mails will then be signed by the new key with the new selector. Old mails can still be verified until you delete the old DNS entry.
- p-e-w 3y agoI don't buy this idea: > As a user, you probably don’t want your emails to be non-repudiable. (Other people might want to be able to prove you sent some email, but your email system ought to serve your interests, not theirs.) Other people being able to verify that an email really was sent by me does serve my interests, because such verification establishes trust. That's like claiming signing a contract isn't in your interest, because others will be able to prove that you agreed to its terms. There are very few legitimate situations where you don't want non-repudiation (and in most of these, you shouldn't use a standard email system anyway), while in many cases, non-repudiation is legitimately valuable – for both sender and receiver.
- precommunicator 3y agoSure. I don't know if that's the case only for Gmail, but after email is received, generally, it's verified and results, at the point of receiving are stored on your email server. He's talking about verification after that initial verification. And if you want your emails to be verified, you should be using GPG/PGP/S.MIME or other signing system anyways. DKIM only verifies server, not user.
- ilyt 3y agoBut it also verifies nobody tampered with e-mail after it left the server and that is still valuable. As in the DKIM signature doesn't mean it was really the sender that sent it, but it does say that it wasn't changed after that.
- withinboredom 3y agoI was a expert witness on a case where a dad had modified an email as proof to drop their daughter out of school. The mom was quite pissed that he did this. I used the DKIM keys to prove the email she submitted was true and his version was not the original. It was a fun case.
- nulbyte 3y ago> Other people being able to verify that an email really was sent by me does serve my interests, because such verification establishes trust. DKIM, the technology considered by the article, does not prove this. The D stands for domain; it asserts nothing about the user that may have sent the email. Even if the domain is yours, you might delegate to another service or two, or you may have more than one user, or some automation in place. In any case, the recipient has little, if any, way to verify that and in all likelihood doesn't care that much; if they did, they wouldn't be relying on DKIM. > There are very few legitimate situations where you don't want non-repudiation... As a service provider, I'd probably want this. If it gets me out from the middle of someone else's dispute and doesn't have an ill effect on the service otherwise, I'd welcome it.
- time4tea 3y ago[flagged]
- donatj 3y agoI don’t think this is as cut and dry as the author would have you believe. Given the options, I think I would rather have the class of problems that come with being able to prove where an email originated instead of the problems that arise from not being able to do so. Proof protects a lot of innocents from bad actors in a lot of ways. Lack thereof protects whistleblowers and the like. It’s not a totally clear win one way or the other. I just suspect the prior helps more people.
- remram 3y agoThis deficiency just makes email a worse mechanism overall. Repudiable channels still exist, they are just not email. Why not fix email?
- dmarinus 3y agoIs there any service which automatically indexes and archives DKIM keys? It could be very valuable to check the authenticity of old e-mails.
- handsclean 3y agoHere’s the thing about deniability: even if you successfully remove all cryptographic proof of provenance, actually denying it is still asserting a frame job. That’s useless if the party you’re trying to mislead either is or trusts the data source, like, say, in the case of police surveillance, hackers, nation-state attackers… I think the real solution to future breaches is ephemerality, which is why it’s critical for any secure messaging service to not only implement all-participant auto-delete, but to also make it easy to opt in to only for specific messages, since that brings the cost:benefit down to a point that it’s actually used.
- JoBrad 3y agoThe frame job is not a stretch. I’ve seen spear phishing campaigns that spanned weeks to convince someone that’s request to transfer money, at the very end, was legit. Some of the intermediate emails were pretty innocuous.
- handsclean 3y agoThat’s just impersonation, framing is when it’s about how you make the real party look, not yourself. Which would be weird, not implausible, but you get to implausible when you assert not just that somebody framed you, but that you were framed by some specific trusted party like the police or Google, and also you have zero evidence.
- matthewdgreen 3y agoPeople fake emails all the time: see examples in this comment thread. Literally all it takes is a text editor. This is not the same thing as a criminal frame job, where someone is going to put your fingerprints on a knife at a bloody crime scene.
- kro 3y agoRotating (and removing old keys from DNS) without publishing the private keys would already make it really hard. For proving an old signature you'd lack an _authentic_ source for the signing public key that could only really be a dump of the historic DNS trace with all DNSSEC signatures (i.e. gmail does not use it).
- talent_deprived 3y ago"You should be rotating the key regularly and automatically, and publishing old private keys." OK, I read the article, I operate my own email server and nothing I read convinces me I should do what they're suggesting.
- talkingtab 3y agoThe article advocates publishing old DKIM keys in order to provide deniability. You create a new DKIM key, publish the old one. With the old dkim key forging an old email is relatively easy. Someone takes you to court and submits an old email that you sent as evidence. You can demonstrate that it is possible that anyone could have signed that email using the now-published DKIM key. It is interesting that you can do this. A question is whether and when you would want to do so. Someone points out that good or bad conspirators might want to this: you send out anti-Putin emails and can deny it. Other ones? Another point seems to be that DKIM is really designed not to verify emails, but to verify email senders. <humor> Understanding this, I wonder if there are other things you can do with email using the same DKIM signing kind of mechanism. Like what about an OSIM signature, that uses a key only issued to email services that are not Google or Hotmail or one of the other big email people. If the message does not come from an OSIM host, then the email is delivered but goes into a o_spam folder? <end humor/>
- EdiX 3y agoThis whole meme started because people could use DKIM to verify that Hunter Biden really did send his incriminating emails while we were all supposed to think they were russian disinfo. Some people are literally so politics poisoned that they can't see that it cuts both ways. I can't wait until DKIM is used to prove something bad about Trump so everyone can flip their position on DKIM. It isn't going to change anything, politics poisoned brains won't see the irony. But it's always funny to see anyway.
- remram 3y agoThe point is that it allows something it is not designed for. I don't think anyone is against it because it hurt their political party, the cat is out of the bag on that front anyway.
- pseudalopex 3y agoPolitics poisoning is thinking no one has principles or own interests. Or noticed OTR, Signal, Telegram in 10 or 20 years.
- Frankmartin321 3y ago[dead]
- ocrow 3y agoA global database of which DKIM keys were served by which mail domains on which day would not be hard for anyone to create and would make it possible to cryptographically validate the sending host after the fact, even for hosts that rotated and published old DKIM key pairs, surely? This technique to make old emails repudiable doesn't seem very robust.
- gumby 3y agoThat would make the system even easier. The point of this proposal is that with rotation someone could not prove that a message hadn’t been forged retrospectively. It would then be almost impossible to establish an airtight chain of custody
- remram 3y agoThat does not break the scheme at all? In fact it is counting on it. The point is to publish the private keys, which would match the public keys in your database. The point is to forge emails, not domain keys.
- upofadown 3y agoOK, rotating the DKIM keys allows someone to send an email and then later claim that the email was a forgery. But the fact that the DKIM keys are rotated is going to be generally known. So how could this possibly work? Someone comes to you and claims that a particular email was forged. They have no evidence of this forgery and no evidence that someone was even motivated and capable of doing such a forgery. You check and see that DMIM rotation is being done. Wouldn't the fact that there was a system set up specifically to allow someone to send an email and then lie about it make you very suspicious that they had done exactly that? Forwarding an the email to a third party entirely defeats this scheme, doesn't it?
- remram 3y ago> Wouldn't the fact that there was a system set up specifically to allow someone to send an email and then lie about it make you very suspicious that they had done exactly that? Not really, not when people have been arguing for this setup as a best practice for years for whole domains.
- joveian 3y agoThe argument is that the system as a whole shouldn't be set up in a way to provide (possible, limited) non-repudiation, similar to how postal mail (at least in the US) doesn't provide non-repudiation. It is not something that most people individually would have a say in how it is set up. Publishing expired DKIM keys wouldn't let you claim to the recipient that the message was forged but would make it harder to convince third parties in some contexts that the message is likely to be authentic. The advantage of deniability is that someone who manages to get one email of yours by any means can't prove to the world that you sent it, which can be an issue with things that are socially considered unfavorable as well as unsympathetic situations like corrupt politicians. There are disadvantages relating to harassment and corruption. The article doesn't mention it but trusted timestamping during the validity of the DKIM key (plus as always having a copy of the public key) preserves the (limited) non-repudiation. Forwarding during the DKIM key validity could potentially work as a reliable timestamp depending on the details of the forwarding.
- time4tea 3y agoMy previous comment was flagged, but I'm happy to restate. The author doesn't understand what repudiate means, and therefore all the arguments are nonsensical. To repudiate means, according to Cambridge dictionary "to refuse to accept something or someone as true, good, or reasonable" So, when a transaction or email is repudiated, it means that someone is claiming that they didn't do it, despite the fact that it was done. Non-repudiation is a characteristic of a system whereby a user of the system will find it difficult or "impossible" to repudiate that they did an action in that system. So when the author claims in a title that "Non-repudiation of emails is undesirable" they are getting the words and meaning mixed up. It is repudiation that is undesirable, and that's why non-repudiation is such an important characteristic of some types of system.
- phyzome 3y agoSorry, this is incorrect. Non-repudiation is undesirable for email senders. It is desirable in some other systems, such as notarization and the signing of contracts.
- tbrownaw 3y agoNo, it's undesirable for people who intend to lie about what they said. This group is not congruent with the "email senders" group.
- phyzome 3y agoWould you be comfortable about having everyone you interact with secretly videotaping and recording you, and possibly publishing embarrassing clips 5 years later? Deniability allows you to have low-stakes, casual interactions rather than having every stupid utterance timestamped and notarized for possible public viewing later.
- michaelmrose 3y agoIf we retain a functional society with reasonable rights for all aren't the "victims" of non-repudiation going to be virtually exclusively bad actors? People at real risk should probably be using something more secure like signal whereas people like US senators using a platform to communicate that can't be audited at need should probably go straight to prison on principal.
- tamimio 3y agoThe whole idea of DKIM and SPF checks and even DMARC policy is to fulfill the “integrity” part of the email communication by authenticating it to prevent unauthorized parties to send emails on behalf of a domain they don’t own. For DKIM, the mail you send will have the public key, then the header is signed with the mail server private key, similarly, the recipient side use the public key to verify the private was used, and to make sure the email was not tampered with in the way. Now, that boring theory to show that the idea is to prove it was you (the domain) who sent it -keep in mind DKIM won’t prevent spoofing, it’s meant to prevent spam, you should combine DKIM with your DMARC policy to make sure the domain in Form is not altered-, so trying to find a way that you can says later “it probably wasn’t me” defeats the purpose of these integrity checks, and doesn’t even make sense to be honest, if you’re too concerned about leaked emails, encrypted it with GPG, still not the most optimal solution since meta-data is still leaking, at the end of the day, emails are not meant for secure communications.