Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions.

How can one determine the key length that is being used simply by looking at the headers ?

And I'm assuming the attack is as follows: correct me if I'm wrong:

  1. Factor the private key (of short key length) by knowing the public key, the mechanism (i.e. RSA etc)

  2. Spoof the e-mail, replace the DKIM hash with hashes illegally calculated

  3. Fool the verifier into thinking that the e-mail's origin is proper

  • Interesting question. It's certainly an odd situation - I'll have to read into it.
    – Polynomial
    Commented Oct 25, 2012 at 18:54
  • 1
    Yes, that's pretty much it. What is the question here?
    – AviD
    Commented Oct 25, 2012 at 19:37

2 Answers 2


I've written a DKIM parser and signer for Microsoft Exchange so this is pretty straightforward. Just note that the public key stored in DNS isn't a typical public key, it is in a more compact form called "public key subject form".

How can one determine the key length that is being used simply by looking at the headers ?

  1. Do a TXT query for the following values in the header: {s value}._domainkey.{d value} (omit brackets)
  2. Extract the value named "p=" in the above DNS query
  3. Use an ASN.1 parser to determine the key length and other things that are stored within the

Example Public 2048 bit key found in a DKIM "p=" query with an exponent of 65537


Simply paste this key into the ASN.1 Javascript decoder to figure out the key length. Most programmers will just have a library to figure this out.

  • There are many software to facilitate brute force password hashes (john, cryptohaze, hashcat, etc). So, what software do you recommend for factoring an RSA key ?
    – Yohann
    Commented Oct 28, 2012 at 12:34

The RSA signature size is dependent on the key size. A 512 bit key produces a 64 byte long signature. The header ends with a Base64 encoded signature, so with padding my memory tells me that will be 88 bytes long. So, key length can be determined just by looking at a signature.

Factor the key, sign with the key (because you now have it), and send with all the expected headers.

For the longer version / explanation of this, see RSA signature size? on StackOverflow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .