Re: [Dcrup] draft-ietf-dcrup-dkim-crypto-00

[Jim Fenton <[e-mail]>]

On 5/19/17 7:42 AM, John Levine wrote:
> In article <[e-mail]> you write:
>> Hi,
>>
>> I suggest that 2048 bit RSA be considered the minimum key size.
>> Samller sizes are not really safe these days.
> I'm surprised to hear this.  Remember that DKIM signatures are
> relatively low value and not intended to be archival.  They're
> typically verified within a day of being signed, and the design
> encourages key rotation (although I admit that in practice most people
> don't rotate very often.)

Factoring a key gives the attacker the ability to sign messages, so how
quickly the signature is verified and its not being intended to be
archival is not relevant. Frequency of key rotation is the only thing
that matters (along with the value of the signature).
>
> How much effort does it take to crack a 1k signature?

From 2012: https://www.wired.com/2012/10/dkim-vulnerability-widespread/

tl;dr: factored a 512-bit key on AWS in 72 hours for $75. But that was 5
years ago. I haven't extrapolated to current compute costs/speeds or the
longer key.

-Jim