BLOG

Gmail sending out warnings for 512 bit DKIM keys

As an update to yesterday’s post, Gmail is contacting postmasters at domains signing with 512 bit keys to warn them of the upcoming changes. This message also clarifies “DKIM keys failing.” Messages signed with 512 bit keys or less will be treated as unsigned by Gmail in the next week or so.

Hello,

We noticed that your domain is sending email to Gmail users that is DKIM signed with a 512-bit RSA key. RFC 6376 requires DKIM signing mail using RSA keys of at least 1024-bits for long-lived keys (https://tools.ietf.org/html/rfc6376#section-3.3.3). Shorter keys could be factored by an attacker. As you may know, this attack has been publicly reported. US-CERT has also issued an advisory to upgrade all keys lower than 1024-bits (http://www.kb.cert.org/vuls/id/268267).

As such, we strongly encourage you to upgrade your RSA keys to be at least 1024-bits long.

To best protect our users, Gmail will begin treating emails signed with 512-bit keys as unsigned in about a week. If you continue to use your current key, your messages will not DKIM authenticate.

Affected key:
example._domainkey.example.com descriptive text “k=rsa; p=AKDA3adkelLHaK653IuYD aVgIFc/FBvErvNOkCAwEAAQ==;”

Thank you,
Gmail Team

6 comments

  1. Daniel Gibby says

    I think Google has incorrectly sent me the email. I updated my DKIM to a 1024 bit key this week; after which Google emailed me telling me that my new key was 512 bytes,but they included the new 1024 bit key in the email.

    I double checked that the key I am setup with is 1024 by using this tool, and it says it is 1024:
    http://www.protodave.com/tools/dkim-key-checker/

    Key Length (bits): 1024
    Version:
    Key Type: rsa
    Notes:
    Public Key:

    —–BEGIN PUBLIC KEY—–
    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDuhTYX1HJv3JKy24WzyTBNKcP3JswarPzWod477h
    UJrpj1R6a0boD/q73TAocf5W5CDPh1LOm5tx0h7AQRnKoOnSBxST6JFIjIFTrvUfjH/DgOuWVCyB53
    zHaXK9cAcCp0ZpDiops0wRINoCHjPltZ7hIEP7VyNLLww8w2ZBtw0QIDAQAB
    —–END PUBLIC KEY—–

    That looks like a 1024 bit key to me. The 512 bit key was visibly shorter, about half as short in fact.

    I think Google may have looked through past email, but in the email sent out the current key, not the key that had been in the emails I sent before the upgrade.

  2. Neil Schwartzman says

    at least one of my accounts is losing email today (spamcop reports, password resets). Cause and effect? Time will tell.

  3. Neil Schwartzman says

    Update: there seemingly some significant delays with one of my Gmail accounts for at least the past 24 hours, but I did get the backlog all in a clump around 22:30 last evening. Doesn’t appear to be DKIM related, as spamcop user confirmation reports as signed by DK not DKIM (!)

  4. dialogue1 E-Mail-Marketing Blog says

    Gmail wird wählerisch bei DKIM…

    In wenigen Tagen beginnt Gmail damit, zu lasch verschlüsselte DKIM-Signaturen in E-Mails zu ignorieren – und wie fehlende Signaturen zu behandeln. (siehe Artikel in Word to the Wise) Damit sind vor allem 512-bit RSA-Schlüssel gemeint, die sich ja per B…

  5. Network Support Essex and London says

    Network Support Essex and London…

    Gmail sending out warnings for 512 bit DKIM keys – Word to the Wise…

  6. DKIM and Gmail – Word to the Wise says

    [...] Gmail seem to be requiring in order for them to consider your mail DKIM signed, based either on statements from Google or watching what Gmail does with badly signed [...]

Comment:

Your email address will not be published. Required fields are marked *

  • AOL compromise

    Lots of reports today of a security problem at AOL where accounts are sending spam, or are being spoofed in spam runs or something. Details are hazy, but there seems to be quite a bit of noise surrounding this incident. AOL hasn't provided any information as of yet as to what is going on.4 Comments


  • ReturnPath on DMARC+Yahoo

    Over at ReturnPath Christine has an excellent non-technical summary of the DMARC+Yahoo situation, along with some solid recommendations for what actions you might take to avoid the operational problems it can cause.No Comments


  • AOL problems

    Lots of people are reporting ongoing (RTR:GE) messages from AOL today.  This indicates the AOL mail servers are having problems and can't accept mail. This has nothing to do with spam, filtering or malicious email. This is simply their servers aren't functioning as well as they should be and so AOL can't accept all the mail thrown at them. These types of blocks resolve themselves. 1 Comment


Archives