Skip to content

Update DKIM-ID - #30

Merged
Humbedooh merged 1 commit into
apache:masterfrom
sbp:dkim-id
Jun 3, 2021
Merged

Update DKIM-ID#30
Humbedooh merged 1 commit into
apache:masterfrom
sbp:dkim-id

Conversation

@sbp

@sbp sbp commented Jun 1, 2021

Copy link
Copy Markdown
Contributor

The DKIM-ID implementation in Foal is outdated, and corresponds to a very early design in Ponymail's PR 517. This new PR not only brings the design up to date with PR 517, but makes the following extra improvements:

  • Uses Style O, the compromise solution for ensuring that messages imported into lists with different list IDs result in different DKIM-IDs generated
  • Increases the length of the DKIM-ID from 26 characters to 32 characters, giving 160 bits of security instead of 120 bits of security. This brings collision attacks out of the currently known capabilities of even nation states
  • Changes the hash algorithm from SHAKE-128 to truncated SHA-256 HMAC. It was necessary to use an algorithm that can provide more than 128 bits of non-collision security in order to get 160 bits of non-collision security, and it was necessary to use a keyed algorithm in order to mix in the list ID. Candidates implemented in Python were SHAKE-256, BLAKE-3, and truncated SHA-256 HMAC. There is no way to key SHAKE-256, and BLAKE-3 is only implemented in Rust in PyPI and may not even be added to Python 3.10. Therefore truncated SHA-256 is the only remaining option, if not a perfect one

Humbedooh added a commit that referenced this pull request Jun 2, 2021
dkim algo needs changed unit test results as the algo has changed.
Pending #30
@Humbedooh

Copy link
Copy Markdown
Member

I'll look into updating our unit tests for this, looks good at a first glance.

@sbp

sbp commented Jun 2, 2021

Copy link
Copy Markdown
Contributor Author

I added a commit to this branch to fix another bug, but split it out into PR #32 instead, hence the force push from 2768570 to cfb89dc.

@sbp

sbp commented Jun 2, 2021

Copy link
Copy Markdown
Contributor Author

Rebased onto master.

@Humbedooh
Humbedooh merged commit 188a5e5 into apache:master Jun 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants