Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Jim Fenton <[e-mail]>]

On 1/7/20 3:41 PM, Scott Kitterman wrote:
> https://sha-mbles.github.io/
>
> If I'm reading this right, the last excuse that still trusting SHA-1 DKIM 
> signatures is an OK thing to do is gone.  Comments from anyone that really 
> understands thus stuff would be appreciated.

I can't say that I fully understand how a chosen-prefix collision
affects security of DKIM but...

We've always asserted that DKIM provides limited security because of its
dependence on DNS for publication of public keys. I don't think that
this attack on SHA-1 changes that much. If someone wanted to spoof
DKIM-signed messages from an arbitrary domain, they would probably look
for a domain publishing a relatively short public key, expend the effort
to factor it, and then they would be able to sign as much email from
that domain as they want, until someone notices and revokes the key.
Creating a new message that has a SHA-1 collision would only allow that
specific message to be signed, and I'd expect it to look pretty strange.

That said, we're in fairly good shape. DKIM has, from its initial
publication, had SHA256 as mandatory-to-implement for both signers and
verifiers. A very unscientific search of my inbox came up with with 8102
instances of SHA256 signatures and 548 instances of SHA-1 signatures
(yes, I have a far too big inbox, and some messages were signed multiple
times). But unfortunately the SHA-1 signatures probably come from a
"long tail" of domains.

Someone with access to a more comprehensive corpus of email than my home
domain might want to catalog and try to contact domains using SHA-1, and
encourage them to change: "some recipients may not trust your DKIM
signatures any more". Some PR (magazine articles, etc.) might help, too.

-Jim