Login
You're viewing the federate.social public feed.
  • hannohanno@mastodon.social
    May 19, 2026, 7:12 AM

    Hot take: DKIM signatures with ed25519 are largely useless🔥🔑

    I know what you're thinking. RSA is bad. You read that blogpost with the "f" word. (It's not good.) This isn't about ed25519 vs. RSA, but about how DKIM works

    Here's the problem: if you introduce a new crypto algorithm into a protocol, you need to know if the other side" supports it. But in DKIM, you don't. You're sending e-mails to arbitrary receivers. DKIM has no mechanism to tell you if that receiver supports any algorithm.
    🧵

    💬 4🔄 8⭐ 0

Replies

  • hannohanno@mastodon.social
    May 19, 2026, 7:14 AM

    So you have a new algorithm, but you don't know if the receiver supports it. What do you do? You can add two signatures. If you're lucky and the receiver implements DKIM correctly (not a bet I'd take), that should work, as it'd ignore signatures with keys it doesn't support.

    However... what did you win? You added complexity by now creating two signatures.

    Now, you might say: doesn't RSA have so many security issues. Well, it's complicated, and... you're not protected anyway.

    💬 2🔄 0⭐ 0
  • hannohanno@mastodon.social
    May 19, 2026, 7:15 AM

    The vast majority of RSA security issues are implementation issues with RSA encryption. We're talking about signatures here. Anything RSA encryption-related is irrelevant. (I have some authority to speak about that, I wrote an impactful paper on it.)

    The relevant implementation flaws in RSA signatures can entirely be avoided if you follow what everyone's been recommending for ages: use a standardized e value of 65537 (and not e=3).

    But... it's all irrelevant anyway.

    💬 1🔄 0⭐ 0
  • hannohanno@mastodon.social
    May 19, 2026, 7:17 AM

    Given that you cannot practically have ed25519-only signatures for DKIM, as you always need the RSA signature for the receivers that don't support it, in case of an RSA vulnerability, you are still affected.

    The attacker can just ignore your ed25519 key and attack RSA.

    The main advantage of elliptic curve crypto is key+signature size and speed. But given that you are replacing RSA with RSA+ed25519, it should be obvious that speed+size aren't improved either.

    💬 1🔄 0⭐ 0
  • hannohanno@mastodon.social
    May 19, 2026, 7:19 AM

    So: given the lack of a negotiation mechanism, ed25519 signatures in DKIM have no advantage for security, speed, or size. They add complexity, and the risk of receivers not properly ignoring them if their implementation is not following the standard properly.

    (This came up on the mailop list where someone appeared to have issues with ed25519 signatures.)

    💬 1🔄 0⭐ 0
  • Clemensneverpanic@chaos.social
    May 19, 2026, 10:23 AM

    @hanno Agree with you on this. Migrating to ed25519 doesn't give you enough added value for the additional effort it takes.
    I wonder if that consideration will change with PQC signing, but I'm guessing ML-DSA is a bit on the larger side for DKIM signing anyway, so people might be holding out for other algorithms? Is there any progress on getting PQC signing specified for DKIM?
    I'm also guessing there's no rush. Spammers aren't going to invest in quantum computers... 😂

    💬 1🔄 0⭐ 1
  • hannohanno@mastodon.social
    May 19, 2026, 10:43 AM

    @neverpanic I wondered whether I should include notes on post-quantum, but it would've made things a lot more complicated. I think the short answer is, if QCs really become an actual threat, there needs to be a solution, but it will probably require more than adding another algorithm identifier, and should be thought of as a careful redesign of DKIM.

    💬 1🔄 0⭐ 0
  • hannohanno@mastodon.social
    May 19, 2026, 10:45 AM

    @neverpanic we're already seeing this in the WebPKI where people start to design something that is, basically, completely revamping how WebPKI works from the ground (Merkle Tree Certificates, and, I have to admit, I have only a vague idea how that works).
    How that'll play out for DKIM with quite different considerations is not something I think anyone can answer in a few socialmedia posts.

    💬 0🔄 0⭐ 0
  • bwsbws@social.linux.pizza
    May 19, 2026, 7:18 AM

    @hanno you could also say: whoever does not support ed25519 in the year 2026 just should not be worthy getting an email from me. Not a call you can make everywhere but if you're in the position to not have to care (which is only small private self-managed mailservers and gmail) then you're fine i think 👍🥸

    💬 1🔄 0⭐ 0
  • hannohanno@mastodon.social
    May 19, 2026, 7:20 AM

    @bws That includes >90% of the e-mail market.

    But also: why? why would you demand that people support an added algorithm that has no advantage in this setting? Just because it's more "modern"?

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • kpcyrd 🏳️‍🌈🏴kpcyrd@chaos.social
    May 21, 2026, 2:17 PM

    @hanno Considering CVE-2023-49092 is still ongoing, I believe it's easier to call out and fix buggy DKIM implementations, instead of artificially keeping RSA alive.

    The concern are not spammers, the concern is that DKIM signatures get used in court, so you may not want to use "the algorithm that is notorious for leaking it's own private key through side channels".

    💬 0🔄 0⭐ 0
  • Clemens Zaunerczauner@vivaldi.net
    May 21, 2026, 4:32 PM

    @hanno Hotter take: DKIM is useless. Just look at the amount of spam with valid DKIM signatures.

    Because the simplons pushing it decided that server-side-side signing is OK. Anyone with a half brain had predicted the current state of affairs.

    💬 0🔄 0⭐ 0