News for hackers. Stuff that matters.
Re:DKIM: Show Your Privates by Thorrez on Tuesday November 03, 2020 @03:36AM (#24977664)
>Is the author just building plausible deniability by publishing the keys?

Yes.

>Would this even truly stand up as believable for any scenario?

The post says this will most likely only work in a leak situation rather than a legal dispute. An example of where this might be useful: You send an email to a friend revealing something sensitive about yourself. A hacker hacks your friend's email and leaks it out. Without plausible deniability, everyone can verify cryptographically that you did in fact say that sensitive stuff (assuming your own email didn't get hacked). With this technique, people cannot verify whether or not you said it, the email might be a fraud and so people are less likely to believe the sensitive thing about you.

Re:DKIM: Show Your Privates by outsomnia on Tuesday November 03, 2020 @04:48AM (#24978070)
> With this technique, people cannot verify whether or not you said it, the email might be a fraud and so people are less likely to believe the sensitive thing about you.

If the recipient can prove he had the signed email before the signing private key was made public, eg, by contemporary third party notarization, the keys becoming public later don't help with disclaiming it at all.

Re:DKIM: Show Your Privates by some_furry on Tuesday November 03, 2020 @05:40AM (#24978323)
Yes, that's the point though: To make DKIM not serve as a non-repudiation mechanism. It forces actors to go through other notarization steps instead of relying on DKIM.
Re:DKIM: Show Your Privates by outsomnia on Tuesday November 03, 2020 @06:10AM (#24978520)
> Yes, that's the point though: To make DKIM not serve as a non-repudiation mechanism.

The devil is right in the details... it is serving just as perfectly fine as a non-repudiation mechanism as it ever was, just constrained in time to a day or so as suggested by the article. Depending on what you said to whom that you wish you hadn't said, that can be all you need to get into trouble.

Re:DKIM: Show Your Privates by some_furry on Tuesday November 03, 2020 @06:24AM (#24978603)
Are you familiar with the concept of Post-Compromise Security?
Re:DKIM: Show Your Privates by outsomnia on Tuesday November 03, 2020 @06:42AM (#24978714)
There is no compromise and no security breached. Just a guy who really did say something and wishes there was no evidence he said it.

Publishing the privkey just makes it so in other circumstances where he might strongly wish that he had evidence he HAD said something, the dkim signature is devalued.

Re:DKIM: Show Your Privates by some_furry on Monday November 09, 2020 @12:24AM (#25031715)
The author is nonbinary, not male.
Re:DKIM: Show Your Privates by Thorrez on Tuesday November 03, 2020 @06:41AM (#24978705)
Yes. In the specific example that I gave though (the recipient being your friend), it likely wouldn't happen because your friend is not going to get something notarized to use against you. There could still be a problem if the hacker has control of your friend's email account while you send your email, because then the attacker can get it notarized.
Re:DKIM: Show Your Privates by ryan-c on Tuesday November 03, 2020 @05:40AM (#24978324)
I'm not a he, but you're correct that a counterparty can easily break delayed key disclosure as a way to have plausible deniability. This was brought up in the Twitter thread (though reading a conversation on Twitter that has any forks is... a chore) started by Matthew Green.
Re:DKIM: Show Your Privates by Thorrez on Tuesday November 03, 2020 @06:48AM (#24978748)
Thinking about this more, maybe an alternate technique to provide plausible deniability is to setup a service that acts as a signing oracle with your private key. To avoid it being used for impersonation you might be able to implement a system that receives signing requests via email, and will only sign emails that have the "to" address equal the source of where the signing request came from.
Re:DKIM: Show Your Privates by ryan-c on Tuesday November 03, 2020 @07:05AM (#24978860)
Attack: Sign up for email accounts at major providers, use the signing oracle to sign spam emails, submit to provider, domain's reputation becomes spammy.

The handling rules standardized by DMARC are to ignore failing SPF when there is a valid DKIM signature, even if the domain doesn't use DMARC. Google, in particular, ignored SPF failures on DKIM signed messages last I checked.

Re:DKIM: Show Your Privates by Thorrez on Wednesday November 04, 2020 @06:07AM (#24988023)
Interesting. What if you required payment, say via Monero, for each signature? That would slow down the creation of spam emails.
Re:DKIM: Show Your Privates by ryan-c on Wednesday November 04, 2020 @06:11AM (#24988038)
If you're a low volume email sender, anything attributed to your domain getting marked as spam can cause serious pain. It's an interesting idea, but not an experiment I care to run.
Re:DKIM: Show Your Privates by cm2187 on Tuesday November 03, 2020 @06:24AM (#24978602)
As long as no one archives your DKIM public keys which are available to anyone who asks.
Re:DKIM: Show Your Privates by Thorrez on Tuesday November 03, 2020 @06:36AM (#24978674)
Why would people archiving your DKIM public keys be a problem?
Re:DKIM: Show Your Privates by cm2187 on Tuesday November 03, 2020 @06:40AM (#24978698)
Sorry I think I misunderstood your post. You are right.