2
$\begingroup$

What is the recommended key length for DKIM? I'm currently thinking about a 1024-bit key vs. a 2048-bit one.

From the crypto point of view for RSA, 2048 or 4096 bits is clearly recommended--no discussion on that point. Having glanced over various posts, it seems there may be some trouble at the mail or DNS level with keys of 2048-bit length.

Moreover, using 1024-bit keys seems to be the current trend.

Which key length is best for DKIM?

$\endgroup$
2
$\begingroup$

Nobody has publicly announced that they've broken 1024-bit RSA (other than via implementation defects that can happen with any key size), but it's not out of the question. I can't find a recent estimate, but when RSA-768 was broken in 2009, the researchers estimated that RSA-1024 would be “about a thousand times harder” and that there was “little doubt about the feasibility by the year 2020 of a matrix required for a 1024-bit NFS factorization”. So 1024-bit RSA should certainly not be used to encrypt confidential data or to authenticate arbitrary entities.

However, DKIM is somewhat less demanding than most cryptography applications. Your adversary is not NSA, it's spammers and scammers. On the scale of how much money they make, the cost of breaking 1024-bit RSA would be totally prohibitive. Furthermore, the impact of a broken key is detectable and correctable: if someone manages to break a legitimate key and makes use of that, there will be emails bearing those traces. This may cause temporary harm, but the key can be revoked. In practice, it's a lot more likely that an adversary would impersonate a legitimate participant by exploiting some misconfiguration of the server than by breaking the cryptography.

So 1024-bit RSA is fine for DKIM at the moment. However, attacks only ever get better. It's possible than an improvement to factoring techniques will make it slightly easier to break RSA, and will bring 1024-bit RSA from “NSA can break it if they really want” to “$10k on AWS”. So you should have an upgrade path ready, which you should always have when it comes to cryptography anyway. You should make sure that your system accepts 2048-bit keys, but it's ok to use a 1024-bit key for now.

$\endgroup$
  • $\begingroup$ But practically speaking, signing and signature verification is rarely a bottleneck in systems like this even if using large RSA keys. I'd say it's worth it to at least use 2048 bit keys. And then you don't need to suddenly switch keys if anybody shows up out of the blue announcing that they cracked 1024 bit keys. $\endgroup$ – Natanael Aug 2 at 18:21
  • $\begingroup$ @Natanael The asker was worried about compatibility, not about performance. Of course everybody should already have upgraded away from 1024-bit RSA, even for DKIM. For that matter, everybody should have upgraded away from RSA. But the world moves slowly. $\endgroup$ – Gilles 'SO- stop being evil' Aug 2 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.