We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud

Re:We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud by maxed on Saturday January 11, 2025 @08:19AM (#42665669)

The latest RFC does require it though (RFC8301):

  Verifiers MUST be able to validate signatures with
  keys ranging from 512 bits to 2048 bits, and they MAY be able to
  validate signatures with larger keys.

I did my master thesis on this topic one year ago and found that all popular mail providers nowadays support 4096 bits, and some even up to 16384 bits.

[ Parent | on HN ]

Re:We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud by Twirrim on Saturday January 11, 2025 @10:22AM (#42666438)

Unfortunately MAY is not MUST. When it comes to RFCs, it's all too common that people won't implement MAYs, and you should operate expecting that. I wouldn't trust any key over 2048 bits to work.

[ Parent | on HN ]

Re:We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud by maxed on Sunday January 12, 2025 @07:35AM (#42673130)

Sorry, I somehow made a typo in the quoted text, the RFC says

  Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096* bits

So mail providers MUST support up to 4096 bits if they follow the latest RFC.

[ Parent | on HN ]