Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions.

How can one determine the key length that is being used simply by looking at the headers ?

And I'm assuming the attack is as follows: correct me if I'm wrong:

  1. Factor the private key (of short key length) by knowing the public key, the mechanism (i.e. RSA etc)

  2. Spoof the e-mail, replace the DKIM hash with hashes illegally calculated

  3. Fool the verifier into thinking that the e-mail's origin is proper

  • Interesting question. It's certainly an odd situation - I'll have to read into it. – Polynomial Oct 25 '12 at 18:54
  • 1
    Yes, that's pretty much it. What is the question here? – AviD Oct 25 '12 at 19:37

I've written a DKIM parser and signer for Microsoft Exchange so this is pretty straightforward. Just note that the public key stored in DNS isn't a typical public key, it is in a more compact form called "public key subject form".

How can one determine the key length that is being used simply by looking at the headers ?

  1. Do a TXT query for the following values in the header: {s value}._domainkey.{d value} (omit brackets)
  2. Extract the value named "p=" in the above DNS query
  3. Use an ASN.1 parser to determine the key length and other things that are stored within the

Example Public 2048 bit key found in a DKIM "p=" query with an exponent of 65537


Simply paste this key into the ASN.1 Javascript decoder to figure out the key length. Most programmers will just have a library to figure this out.

  • There are many software to facilitate brute force password hashes (john, cryptohaze, hashcat, etc). So, what software do you recommend for factoring an RSA key ? – Yohann Oct 28 '12 at 12:34

The RSA signature size is dependent on the key size. A 512 bit key produces a 64 byte long signature. The header ends with a Base64 encoded signature, so with padding my memory tells me that will be 88 bytes long. So, key length can be determined just by looking at a signature.

Factor the key, sign with the key (because you now have it), and send with all the expected headers.

For the longer version / explanation of this, see RSA signature size? on StackOverflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.