https://diziet.dreamwidth.org/16025.html
Account name: [ ] Password [ ] [Log in]
(OpenID?) (Forgot it?) [ ] Remember Me
You're viewing [personal profile] diziet's journal
Create a Dreamwidth Account Learn More
[ ] [Interest ] [Go]
Reload page in style: site light
Ian Jackson
* Recent Entries
* Archive
* Reading
* Tags
* Memories
* Profile
DKIM: rotate and publish your keys
Aug. 15th, 2023 01:08 am
[personal profile] diziet
If you are an email system administrator, you are probably using DKIM
to sign your outgoing emails. You should be rotating the key
regularly and automatically, and publishing old private keys. I have
just released dkim-rotate 1.0; dkim-rotate is a tool to do this key
rotation and publication.
If you are an email user, your email provider ought to be doing this.
If this is not done, your emails are "non-repudiable", meaning that
if they are leaked, anyone (eg, journalists, haters) can verify that
they are authentic, and prove that to others. This is not desirable
(for you).
Non-repudiation of emails is undesirable
This problem was described at some length in Matthew Green's article
Ok Google: please publish your DKIM secret keys.
Avoiding non-repudiation sounds a bit like lying. After all, I'm
advising creating a situation where some people can't verify that
something is true, even though it is. So I'm advocating casting
doubt. Crucially, though, it's doubt about facts that ought to be
private. When you send an email, that's between you and the
recipient. Normally you don't intend for anyone, anywhere, who
happens to get a copy, to be able to verify that it was really you
that sent it.
In practical terms, this verifiability has already been used by
journalists to verify stolen emails. Associated Press provide a
verification tool.
Advice for all email users
As a user, you probably don't want your emails to be non-repudiable.
(Other people might want to be able to prove you sent some email, but
your email system ought to serve your interests, not theirs.)
So, your email provider ought to be rotating their DKIM keys, and
publishing their old ones. At a rough guess, your provider probably
isn't :-(.
How to tell by looking at email headers
A quick and dirty way to guess is to have a friend look at the email
headers of a message you sent. (It is important that the friend uses
a different email provider, since often DKIM signatures are not
applied within a single email system.)
If your friend sees a DKIM-Signature header then the message is DKIM
signed. If they don't, then it wasn't. Most email traversing the
public internet is DKIM signed nowadays; so if they don't see the
header probably they're not looking using the right tools, or they're
actually on the same email system as you.
In messages signed by a system running dkim-rotate, there will also
be a header about the key rotation, to notify potential verifiers of
the situation. Other systems that avoid non-repudiation-through-DKIM
might do something similar. dkim-rotate's header looks like this:
DKIM-Signature-Warning: NOTE REGARDING DKIM KEY COMPROMISE
https://www.chiark.greenend.org.uk/dkim-rotate/README.txt
https://www.chiark.greenend.org.uk/dkim-rotate/ae/aeb689c2066c5b3fee673355309fe1c7.pem
But an email system might do half of the job of dkim-rotate:
regularly rotating the key would cause the signatures of old emails
to fail to verify, which is a good start. In that case there probably
won't be such a header.
Testing verification of new and old messages
You can also try verifying the signatures. This isn't entirely
straightforward, especially if you don't have access to low-level
mail tooling. Your friend will need to be able to save emails as raw
whole headers and body, un-decoded, un-rendered.
If your friend is using a traditional Unix mail program, they should
save the message as an mbox file. Otherwise, ProPublica have
instructions for attaching and transferring and obtaining the raw
email. (Scroll down to "How to Check DKIM and ARC".)
Checking that recent emails are verifiable
Firstly, have your friend test that they can in fact verify a DKIM
signature. This will demonstrate that the next test, where the
verification is supposed to fail, is working properly and fails for
the right reasons.
Send your friend a test email now, and have them do this on a Linux
system:
# save the message as test-email.mbox
apt install libmail-dkim-perl # or equivalent on another distro
dkimproxy-verify