3 ms·

Aw geez, that's a really nasty bug. So with DKIM you're signing some headers and the body. DKIM has a "body length" tag, "l=". Contrary to its name it doesn't

by crote 2y ago

Aw geez, that's a really nasty bug. So with DKIM you're signing some headers and the body. DKIM has a "body length" tag, "l=". Contrary to its name it doesn't say anything about the body length, but it specifies the length of the content being signed - so an attacker can add random crap to the end of the message without invalidating the signature. This combines with multi-part email to essentially let an attacker completely overwrite the message body. To make it even worse, the spec is written quite vague and heavily suggests that inserting "l=" is mandatory, despite also mentioning cases where it isn't present. That's pretty much asking for trouble. And of course all that is made a Serious Problem because DMARC is fundamentally broken and considers a message valid when either SPF or DKIM passes - so it'll happily accept a message with a valid DKIM signature coming from a host who fails SPF.

citrin_ru 2y ago
> spec is written quite vague and heavily suggests that inserting "l=" is mandatory RFC [1] suggest the opposite: "To avoid this attack, Signers should be extremely wary of using this tag" > message valid when either SPF or DKIM passes DMARC is already fragile with many legit messages failing DMARC after a forwarding (redirecting) by a mail servers (which change headers and/or body to varying degree with MS mail products being among the worst). If you would require both SPF and DKIM pass even more legit messages will fail DMARC check so more servers will have to ignore it results. [1] https://datatracker.ietf.org/doc/html/rfc6376#section-8.2 https://datatracker.ietf.org/doc/html/rfc6376#section-8.2
flumpcakes 2y ago
> because DMARC is fundamentally broken and considers a message valid when either SPF or DKIM passes You can specify if you both to pass and in fact it will enforce strict alignment which is more than SPF or DKIM will do on their own. I think SPF/DKIM is probably broken without strict alignment as it's trivially easy to change your mail from header which is transparent to end users and pass SPF on its own.

by crote 2y ago

citrin_ru 2y ago

> spec is written quite vague and heavily suggests that inserting "l=" is mandatory RFC [1] suggest the opposite: "To avoid this attack, Signers should be extremely wary of using this tag" > message valid when either SPF or DKIM passes DMARC is already fragile with many legit messages failing DMARC after a forwarding (redirecting) by a mail servers (which change headers and/or body to varying degree with MS mail products being among the worst). If you would require both SPF and DKIM pass even more legit messages will fail DMARC check so more servers will have to ignore it results. [1] https://datatracker.ietf.org/doc/html/rfc6376#section-8.2 https://datatracker.ietf.org/doc/html/rfc6376#section-8.2

flumpcakes 2y ago

> because DMARC is fundamentally broken and considers a message valid when either SPF or DKIM passes You can specify if you both to pass and in fact it will enforce strict alignment which is more than SPF or DKIM will do on their own. I think SPF/DKIM is probably broken without strict alignment as it's trivially easy to change your mail from header which is transparent to end users and pass SPF on its own.