News for hackers. Stuff that matters.

A comment on Ok Google: please publish your DKIM secret keys. Parent comment

Re:Ok Google: please publish your DKIM secret keys by brightball on Monday November 16, 2020 @03:41PM (#25116739)
Why not just rotate them frequently? Like weekly? Or daily even?

ProtonMail makes you setup 3 CNAMEs for DKIM just so they can frequently rotate without your intervention or disruption. Sendgrid uses 2 for the same thing.

[ Parent | on HN ]
Re:Ok Google: please publish your DKIM secret keys by tomc1985 on Monday November 16, 2020 @03:49PM (#25116829)
What's stopping someone from recording each public key as it is entered into service and providing a DKIM authentication service with it? There are already such things for domain data.
[ Parent | on HN ]
Re:Ok Google: please publish your DKIM secret keys by mspecter on Monday November 16, 2020 @05:46PM (#25118064)
Hi! Check out our Usenix 2021 paper on exactly this topic. The key insight is to release private keys over time:

http://www.mit.edu/~specter/blog/2020/dkim/

[ Parent | on HN ]