9 ms·

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be.html https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b...

Me writing over 14 years ago: https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be.html https://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-b... This was doable 14 years ago for 512-bit keys.

begueradj 2y ago
2010, Nostradamus :)
- jgrahamc 2y ago
  Depends if you're rounding up or down.
deleted 2y ago
[deleted]
raverbashing 2y ago
> "Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware." So we went to a few weeks to 8h in 14 years give or take
- chias 2y ago
  86h, wasn't it? But regardless your point stands.
- bee_rider 2y ago
  86 hours. 8 dollars. I wonder how scalable it is. They only used: > We chose a server with 8 dedicated vCPUs (AMD EPYC 7003 series) and 32 GB of RAM from Hetzner Not very beefy really. Beating this time is easily in range of, what, millions of people high end gaming machines?
  - raverbashing 2y ago
    > 86 hours I stand corrected
  - andix 2y ago
    I'm wondering if this process can be GPU optimized. It's possible to rent really beefy GPU cloud instances for a few bucks per hour. <1 hour seems to be in reach.
- deleted 2y ago
  [deleted]
- ryan-c 2y ago
  I'm pretty sure I can do it in two hours.
matthewdgreen 2y ago
For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were not all bad.) DKIM deniability is a particular hobbyhorse of mine [1]. These short keys are obviously not the way to achieve it, but I view this kind of thing as a result of the muddled thinking that’s been associated with DKIM and the community’s lack of desire to commit to the implications of an all-email signing mechanism. [1] https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
- linsomniac 2y ago
  I forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a level of deniability.
  - rsc 2y ago
    In the link in the parent comment. :-)
  - jabart 2y ago
    Doing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.
    - singpolyma3 2y ago
      As if courts care about any of that. They'll just ask the witness "did you send this email"
      - irrational 2y ago
brightball 2y ago
Reminds me of the story of a guy cracking one thinking it was a Google headhunting challenge. https://www.wired.com/2012/10/dkim-vulnerability-widespread/ https://www.wired.com/2012/10/dkim-vulnerability-widespread/
stingraycharles 2y ago
Just as an interesting FYI for those who care: the parent poster is the CTO of CloudFlare.
codegladiator 2y ago
Your blog got a mention in the comments of http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/ http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-...
littlestymaar 2y ago
First time a 512-bits RSA number (RSA-155) was factored was in 1999!

begueradj 2y ago

2010, Nostradamus :)

jgrahamc 2y ago
Depends if you're rounding up or down.

deleted 2y ago

[deleted]

raverbashing 2y ago

> "Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware." So we went to a few weeks to 8h in 14 years give or take

chias 2y ago
86h, wasn't it? But regardless your point stands.
bee_rider 2y ago
86 hours. 8 dollars. I wonder how scalable it is. They only used: > We chose a server with 8 dedicated vCPUs (AMD EPYC 7003 series) and 32 GB of RAM from Hetzner Not very beefy really. Beating this time is easily in range of, what, millions of people high end gaming machines?
- raverbashing 2y ago
  > 86 hours I stand corrected
- andix 2y ago
  I'm wondering if this process can be GPU optimized. It's possible to rent really beefy GPU cloud instances for a few bucks per hour. <1 hour seems to be in reach.
deleted 2y ago
[deleted]
ryan-c 2y ago
I'm pretty sure I can do it in two hours.

matthewdgreen 2y ago

For a number of years it was (non-officially) thought to be a feature to use weak DKIM keys. Some folks argued that short keys allowed you to preserve deniability, since DKIM signatures would only be short-lived and nobody would be able to use DKIM signatures to prove that any email was authentic. (I’m not saying that this is why most companies used short keys, just that there was a general view that short keys were not all bad.) DKIM deniability is a particular hobbyhorse of mine [1]. These short keys are obviously not the way to achieve it, but I view this kind of thing as a result of the muddled thinking that’s been associated with DKIM and the community’s lack of desire to commit to the implications of an all-email signing mechanism. [1] https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

linsomniac 2y ago
I forget where but someone proposed regularly rotating your DKIM key and publishing old keys for deniability. So you can still use strong keys and provide a level of deniability.
- rsc 2y ago
  In the link in the parent comment. :-)
- jabart 2y ago
  Doing this only provides deniability in public. If this was brought to a court there are enough server logs to build out if that DKIM record was valid along with a number of DNS history providers.
  - singpolyma3 2y ago
    As if courts care about any of that. They'll just ask the witness "did you send this email"
    - irrational 2y ago

brightball 2y ago

Reminds me of the story of a guy cracking one thinking it was a Google headhunting challenge. https://www.wired.com/2012/10/dkim-vulnerability-widespread/ https://www.wired.com/2012/10/dkim-vulnerability-widespread/

stingraycharles 2y ago

Just as an interesting FYI for those who care: the parent poster is the CTO of CloudFlare.

codegladiator 2y ago

Your blog got a mention in the comments of http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/ http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-...

littlestymaar 2y ago

First time a 512-bits RSA number (RSA-155) was factored was in 1999!