Posted by Virus Bulletin on Oct 25, 2012
512-bit key cracked within 72 hours.
A Florida-based mathematician has caused a stir in the email community by adding a valid DKIM signature for google.com to an email after cracking the company's private signing-key.
When the first SMTP standard was published just over three decades ago, email spam barely existed. The email landscape has changed beyond recognition since 1982, and various enhancements have been introduced to help tackle the problem of correctly filtering thousands or even millions of emails per day. DKIM (DomainKeys Identified Mail), which has gained momentum in recent years, is one such feature.
DKIM - which is easily and commonly misunderstood - adds a domain-based digital signature to an email. A valid DKIM signature does not mean the message is not spam, nor does it make any claims about the verity of the content or headers of the email. A valid DKIM signature merely says that the message passed through the mail servers of the signing domain.
Yet in this apparent weakness also lies DKIM's strength: unlike any other part of the email (bar the sending IP address), you can be certain that this domain is not forged. Hence you can use this fact to increase the spam-probability for one domain that is known to send a lot of spam, decrease it for another that you trust to filter outbound email, and make sure you never mark emails from a third, highly trusted, domain as spam.
If, for instance, you believe that Google doesn't mess things up internally, you can be sure that an email claiming to come from [email protected] with a valid DKIM signature for google.com was indeed sent by Google co-founder Larry Page.
But, like so many applications of cryptography, the sound mathematics behind DKIM has little value when the implementation is poor.
Zachary Harris, a Florida-based mathematician, recently discovered that Google was using a 512-bit DKIM key. Without having prior knowledge of DKIM, it took him 72 hours to crack the key and thus he was able to sign a faked message from Larry Page to his fellow co-founder Sergey Brin. Harris did not receive any response to this email, but Google did replace its key with a 2048-bit one.
Google isn't the only high-profile organization to have used a weak key: eBay, Yahoo, Twitter and Amazon all used 512-bit keys, while PayPal, LinkedIn, US Bank and HSBC used keys that were 768 bits long - still too weak for companies that are heavily phished.
After having been contacted by Harris, most companies fixed their keys - though after a few failed to do so, he decided to contact US-CERT and go public with his discovery. A US-CERT announcement can be found here.
DKIM will not solve the spam problem (nor does it claim to do so), but it does add an extra layer of trust to email. With the increase in targeted attacks we have seen recently - the people behind which would generally think nothing of spending 72 hours and an apparent US$75 to crack a key - its importance is likely to increase and thus it is a good thing that DKIM is applied by most major email senders these days. But if they sign their emails with weak keys, they would perhaps do better not to sign them at all.
More at Wired here.
Posted on 25 October 2012 by Martijn Grooten
