<story><title>DKIM: Rotate and publish your keys</title><url>https://diziet.dreamwidth.org/16025.html</url></story><parent_chain><item><author>BoppreH</author><text>I think this is missing the trust that the delegated sender adds. If you have an email with a DKIM signature from Gmail, then either:&lt;p&gt;a. The email is authentic.&lt;p&gt;b. Gmail has risked its reputation to &amp;quot;forge&amp;quot; the signature of an email it never sent.&lt;p&gt;That&amp;#x27;s strong evidence that the email is authentic! On the other hand, if Gmail were to publish their old DKIM keys, &lt;i&gt;anyone&lt;/i&gt; with technical skills could have forged that signature.&lt;p&gt;As for why repudiation is desirable for emails, think protesters. They want to verify that the emails they receive are really from each other, but minimize their exposure in case the emails leak.&lt;p&gt;It&amp;#x27;s a common property for secure messaging systems, and I don&amp;#x27;t see why emails shouldn&amp;#x27;t have it too.</text></item><item><author>LeonM</author><text>So for work I consult on email security and every time this article pops up I get texts from everybody asking for my opinion. So here we go.&lt;p&gt;Disclaimer: opinions are my own.&lt;p&gt;A DKIM signature does not prove that an individual sent the email, the key is not personal. A DKIM signature proves that the sending service is a delegated sender for the domain. Meaning that a correct DKIM signature proves that the part &lt;i&gt;after&lt;/i&gt; the &amp;#x27;@&amp;#x27; symbol in the sender address is authentic. Not the part before that. If you want to use a personal signature, you can use S&amp;#x2F;MIME.&lt;p&gt;If you are a delegated sender for the domain, then you can use any sender name (the part before the &amp;#x27;@&amp;#x27; in the sender email address). This is how email works. The password that is typically required to authenticate with your outbound SMTP service if only enforced by that host.&lt;p&gt;So an email with sender address jane@example.com that is DKIM signed only proves that the email was send by a host that is a allowed to send email on behalf of example.com. It does not prove in any way that the email was sent by Jane.&lt;p&gt;Also, as others have mentioned, none of the email service providers will give you the private keys. I&amp;#x27;d like to add that in most cases this won&amp;#x27;t even be possible, due to the use of HSMs.&lt;p&gt;So the proposed scheme would only work in a situation where you are owner of the DKIM key (thus in practice where you are the owner of the host sending the email), and where you also own the domain. It is trivial for a prosecutor to prove the owner of the domain, or the owner of the host that used the DKIM key. No amount of publishing keys will help you deny that ownership.&lt;p&gt;In my opinion it makes no sense in signing your email (whether it is S&amp;#x2F;MIME or DKIM) to prove that the email is authentic, and then complaining that there is no way to deny that the email is authentic once stuff goes bad.</text></item></parent_chain><comment><author>chias</author><text>I don&amp;#x27;t think that&amp;#x27;s an accurate characterization. If you have an email with a DKIM signature, from Gmail or from a myriad of vendors, then either:&lt;p&gt;a. The email is authentic.&lt;p&gt;b. The service allows whoever administers the service to configure outgoing emails however they please.&lt;p&gt;c. There is a documented method by which the service allows you to override the sender address.&lt;p&gt;d. The service has risked its reputation to &amp;quot;forge&amp;quot; the signature.&lt;p&gt;The middle two options are extremely common in any business setting. Gmail supports both.&lt;p&gt;--&lt;p&gt;I am assuming, since your post does not appear to be agreeing with the parent comment, that when you say &amp;quot;authentic&amp;quot; you mean &amp;quot;sent or authorized by the individual named in the username field&amp;quot;. If you mean &amp;quot;sent in a manner configured by some entity with authority on how the domain is used for sending email&amp;quot;, then that is exactly the parent comment&amp;#x27;s point.</text></comment>
<story><title>DKIM: Rotate and publish your keys</title><url>https://diziet.dreamwidth.org/16025.html</url></story><parent_chain><item><author>BoppreH</author><text>I think this is missing the trust that the delegated sender adds. If you have an email with a DKIM signature from Gmail, then either:&lt;p&gt;a. The email is authentic.&lt;p&gt;b. Gmail has risked its reputation to &amp;quot;forge&amp;quot; the signature of an email it never sent.&lt;p&gt;That&amp;#x27;s strong evidence that the email is authentic! On the other hand, if Gmail were to publish their old DKIM keys, &lt;i&gt;anyone&lt;/i&gt; with technical skills could have forged that signature.&lt;p&gt;As for why repudiation is desirable for emails, think protesters. They want to verify that the emails they receive are really from each other, but minimize their exposure in case the emails leak.&lt;p&gt;It&amp;#x27;s a common property for secure messaging systems, and I don&amp;#x27;t see why emails shouldn&amp;#x27;t have it too.</text></item><item><author>LeonM</author><text>So for work I consult on email security and every time this article pops up I get texts from everybody asking for my opinion. So here we go.&lt;p&gt;Disclaimer: opinions are my own.&lt;p&gt;A DKIM signature does not prove that an individual sent the email, the key is not personal. A DKIM signature proves that the sending service is a delegated sender for the domain. Meaning that a correct DKIM signature proves that the part &lt;i&gt;after&lt;/i&gt; the &amp;#x27;@&amp;#x27; symbol in the sender address is authentic. Not the part before that. If you want to use a personal signature, you can use S&amp;#x2F;MIME.&lt;p&gt;If you are a delegated sender for the domain, then you can use any sender name (the part before the &amp;#x27;@&amp;#x27; in the sender email address). This is how email works. The password that is typically required to authenticate with your outbound SMTP service if only enforced by that host.&lt;p&gt;So an email with sender address jane@example.com that is DKIM signed only proves that the email was send by a host that is a allowed to send email on behalf of example.com. It does not prove in any way that the email was sent by Jane.&lt;p&gt;Also, as others have mentioned, none of the email service providers will give you the private keys. I&amp;#x27;d like to add that in most cases this won&amp;#x27;t even be possible, due to the use of HSMs.&lt;p&gt;So the proposed scheme would only work in a situation where you are owner of the DKIM key (thus in practice where you are the owner of the host sending the email), and where you also own the domain. It is trivial for a prosecutor to prove the owner of the domain, or the owner of the host that used the DKIM key. No amount of publishing keys will help you deny that ownership.&lt;p&gt;In my opinion it makes no sense in signing your email (whether it is S&amp;#x2F;MIME or DKIM) to prove that the email is authentic, and then complaining that there is no way to deny that the email is authentic once stuff goes bad.</text></item></parent_chain><comment><author>zajio1am</author><text>Well, there is also third option: the sender account was compromised.&lt;p&gt;But yes, it is still pretty strong evidence.</text></comment>