5 ms·

I think this is missing the trust that the delegated sender adds. If you have an email with a DKIM signature from Gmail, then either: a. The email is authentic

I think this is missing the trust that the delegated sender adds. If you have an email with a DKIM signature from Gmail, then either: a. The email is authentic. b. Gmail has risked its reputation to "forge" the signature of an email it never sent. That's strong evidence that the email is authentic! On the other hand, if Gmail were to publish their old DKIM keys, anyone with technical skills could have forged that signature. As for why repudiation is desirable for emails, think protesters. They want to verify that the emails they receive are really from each other, but minimize their exposure in case the emails leak. It's a common property for secure messaging systems, and I don't see why emails shouldn't have it too.

zajio1am 3y ago
Well, there is also third option: the sender account was compromised. But yes, it is still pretty strong evidence.
klausa 3y ago
>It's a common property for secure messaging systems, and I don't see why emails shouldn't have it too. Because emails, fundamentally, are not, and cannot be, a secure messaging systems.
- pnpnp 3y ago
  Why not? PGP has proven that it’s possible. You can certainly invent a better greenfield solution than email in 2023, but that’s not to say email doesn’t have room for improvement.
chias 3y ago
I don't think that's an accurate characterization. If you have an email with a DKIM signature, from Gmail or from a myriad of vendors, then either: a. The email is authentic. b. The service allows whoever administers the service to configure outgoing emails however they please. c. There is a documented method by which the service allows you to override the sender address. d. The service has risked its reputation to "forge" the signature. The middle two options are extremely common in any business setting. Gmail supports both. -- I am assuming, since your post does not appear to be agreeing with the parent comment, that when you say "authentic" you mean "sent or authorized by the individual named in the username field". If you mean "sent in a manner configured by some entity with authority on how the domain is used for sending email", then that is exactly the parent comment's point.
zahllos 3y ago
> That's strong evidence that the email is authentic! So I run my own email server for family (mostly) but a couple of friends. As the GP points out, the DKIM keys do not identify the user and in particular I can produce a validly signed email for any user of any of the domains my server hosts. Only CMS oblique S/MIME would provide non-repudiation in the cryptographic sense, and only meet e.g. eIDAS requirements if stored on a hardware token (i.e. in the EU, if I sign a PDF with the USB token I have, it is a "qualified signature" and it can be interpreted as legally binding). On the other hand, there's a question as to what extent courts would understand the distinction between a valid and invalid/no DKIM signature. I guess what I'm saying is if it came down to a contractual dispute, "strong evidence" would not be good enough. If it came down to "this person organised a protest and that's a crime" I think even invalid DKIM would be fine. From what I've seen of court proceedings, mostly stuff shared here and so US stuff and not my native jurisdiction, but I have yet to see anyone cast doubt on an email's provenance based on DKIM. I'm going to go out on a limb and say in strongly democratic jurisdictions an email recovered from a server in someone else's inbox will likely be treated as valid unless there is something like an unusual sender IP to cast doubt on it. So "strong evidence of authenticity" probably won't come from DKIM. In jurisdictions where protesting means you disappear, I doubt "check the DKIM keys!!!" is going to help - at least in part the police/courts might not be so worried about whether you are guilty or not. Agree completely with the sibling comment that e-mail isn't suitable for secure messaging.
michaelmrose 3y ago
Remember when Hans Reiser successfully destroyed all definitive forensic evidence of his murder of his ex and then got convicted anyway because nobody believed he was innocent then traded handing over her body for a lighter sentence? Even if you could theoretically create a mathematically plausible doubt it doesn't matter if a judge and or jury doesn't believe it. Also both Google and the recipient can attest the message hit the server prior to the key being published. You MAY be in a position where your email provider is in a different jurisdiction and not inclined to cooperate but if bob the witness already gave up your message won't he give up the timeline breaking any hope of repudiation? So all hope of an upside is basically a pipe dream. Lets talk about the downside you can now sign crap with Googles already published key and lie about the timeline. You can have "experts" go on TV and lie about authentication. Since most people know less than nothing on the topic it sounds on its face believable.
- pseudalopex 3y ago
  Hans Reiser was convicted because there was much circumstantial evidence, he insisted to testify, his explanations were unlikely, and jurors thought he acted guilty. He said he threw away his car's passenger seat after his ex wife disappeared so he could sleep in the car. And removed the rear carpet to make a futon. But threw it away. And so on. Criminal cases are not the only scenarios when authentication is relevant. Most email providers would not authenticate a message without a court order probably. And they may or may not retain sufficient information. A recipient whose messages were hacked would not want to authenticate the messages usually. A recipient who would benefit from disclosing a message the sender didn't want disclosed would benefit from forging a message usually. Is it now not possible for people to go on TV and lie to people who know less than nothing about a topic?
  - michaelmrose 3y ago
    Its easier if we can go say something half truthful like your blood was found at the scene even if the scene was a kitchen where you had regularly cooked and the blood was of indeterminate age than to make something up from whole cloth. The later is also legally actionable while the former may well not be.

zajio1am 3y ago

Well, there is also third option: the sender account was compromised. But yes, it is still pretty strong evidence.

klausa 3y ago

>It's a common property for secure messaging systems, and I don't see why emails shouldn't have it too. Because emails, fundamentally, are not, and cannot be, a secure messaging systems.

pnpnp 3y ago
Why not? PGP has proven that it’s possible. You can certainly invent a better greenfield solution than email in 2023, but that’s not to say email doesn’t have room for improvement.

chias 3y ago

I don't think that's an accurate characterization. If you have an email with a DKIM signature, from Gmail or from a myriad of vendors, then either: a. The email is authentic. b. The service allows whoever administers the service to configure outgoing emails however they please. c. There is a documented method by which the service allows you to override the sender address. d. The service has risked its reputation to "forge" the signature. The middle two options are extremely common in any business setting. Gmail supports both. -- I am assuming, since your post does not appear to be agreeing with the parent comment, that when you say "authentic" you mean "sent or authorized by the individual named in the username field". If you mean "sent in a manner configured by some entity with authority on how the domain is used for sending email", then that is exactly the parent comment's point.

zahllos 3y ago

> That's strong evidence that the email is authentic! So I run my own email server for family (mostly) but a couple of friends. As the GP points out, the DKIM keys do not identify the user and in particular I can produce a validly signed email for any user of any of the domains my server hosts. Only CMS oblique S/MIME would provide non-repudiation in the cryptographic sense, and only meet e.g. eIDAS requirements if stored on a hardware token (i.e. in the EU, if I sign a PDF with the USB token I have, it is a "qualified signature" and it can be interpreted as legally binding). On the other hand, there's a question as to what extent courts would understand the distinction between a valid and invalid/no DKIM signature. I guess what I'm saying is if it came down to a contractual dispute, "strong evidence" would not be good enough. If it came down to "this person organised a protest and that's a crime" I think even invalid DKIM would be fine. From what I've seen of court proceedings, mostly stuff shared here and so US stuff and not my native jurisdiction, but I have yet to see anyone cast doubt on an email's provenance based on DKIM. I'm going to go out on a limb and say in strongly democratic jurisdictions an email recovered from a server in someone else's inbox will likely be treated as valid unless there is something like an unusual sender IP to cast doubt on it. So "strong evidence of authenticity" probably won't come from DKIM. In jurisdictions where protesting means you disappear, I doubt "check the DKIM keys!!!" is going to help - at least in part the police/courts might not be so worried about whether you are guilty or not. Agree completely with the sibling comment that e-mail isn't suitable for secure messaging.

michaelmrose 3y ago

Remember when Hans Reiser successfully destroyed all definitive forensic evidence of his murder of his ex and then got convicted anyway because nobody believed he was innocent then traded handing over her body for a lighter sentence? Even if you could theoretically create a mathematically plausible doubt it doesn't matter if a judge and or jury doesn't believe it. Also both Google and the recipient can attest the message hit the server prior to the key being published. You MAY be in a position where your email provider is in a different jurisdiction and not inclined to cooperate but if bob the witness already gave up your message won't he give up the timeline breaking any hope of repudiation? So all hope of an upside is basically a pipe dream. Lets talk about the downside you can now sign crap with Googles already published key and lie about the timeline. You can have "experts" go on TV and lie about authentication. Since most people know less than nothing on the topic it sounds on its face believable.

pseudalopex 3y ago
Hans Reiser was convicted because there was much circumstantial evidence, he insisted to testify, his explanations were unlikely, and jurors thought he acted guilty. He said he threw away his car's passenger seat after his ex wife disappeared so he could sleep in the car. And removed the rear carpet to make a futon. But threw it away. And so on. Criminal cases are not the only scenarios when authentication is relevant. Most email providers would not authenticate a message without a court order probably. And they may or may not retain sufficient information. A recipient whose messages were hacked would not want to authenticate the messages usually. A recipient who would benefit from disclosing a message the sender didn't want disclosed would benefit from forging a message usually. Is it now not possible for people to go on TV and lie to people who know less than nothing about a topic?
- michaelmrose 3y ago
  Its easier if we can go say something half truthful like your blood was found at the scene even if the scene was a kitchen where you had regularly cooked and the blood was of indeterminate age than to make something up from whole cloth. The later is also legally actionable while the former may well not be.