Attacking Domain Keys

On Fri, 2004-11-26 at 10:04 +0000, David Woodhouse wrote:
> On Fri, 2004-11-26 at 00:42 -0800, James Couzens wrote:
> > You should absolutely NOT be trying to implement
> > a cryptographic solution to the worlds most widely and diversely
> > deployed Internet technology which puts the BURDEN _FULLY_ on the
> > shoulders of the recipient.
> >
> > Odd to have everyone looking so intently at it and yet no one other than
> > John Levine (that I have read) has voiced this concern out loud.  Wonder
> > how that makes everyone look?
> CPU power is cheap enough that I think most people really don't see it
> as a problem; I certainly don't.
>
> Most highly laden mail servers are presumably more I/O and network-bound
> than CPU-bound. Has there been a serious study of how the demand for
> crypto would affect that? 
>
> Perhaps I might not be able to run my primary mail server on a dual
> Pentium-200 machine any more; but then again I already run it IPv6-only
> to keep its SpamAssassin load down, because SA _does_ chew CPU. It
> accepts most of its mail from the MX backups which do have addresses on
> the Legacy Internet, using crypto (SMTP+TLS).
>
> It would certainly be interesting to see a study of how CPU load on mail
> servers would be affected by DK; especially one which recognises the
> fact that you don't actually have to run other CPU-intensive checks like
> SpamAssassin and virus checking on mails which were already rejected due
> to the crypto check.
>
> The cost of the crypto is perceived to be negligible. If you feel
> strongly that it's not negligible, you'd need to show numbers to
> convince me (and others) of that. Especially so if you're claiming it's
> not just non-negligible, but prohibitive.
With all due respect, please, THINK BIGGER.  How about AOL.  Just how is
AOL with 90M mailboxes going to deal with my 1,000 node drone army that
is spewing forth 100,000 fake signed messages laden with random data
going to do?

As an "attacker" I can randomly generate and sign a massive volume of
messages destined to the victim, who falls victim to the burden of not
only having to perform public key cryptography, he also can't do
anything until paying I/O costs as well since the DK key is signed in
2822 they have to wait for DATA to finish and then they have to parse
the data to look for the signature that I signed which cost me nothing
because I just generated gibberish looking valid.

Do the math on that, it doesn't take much load before you are no longer
receiving any email.

Cheers,

James

-- 
James Couzens,
Programmer
                                                     ( ( (      
      ((__))         __\|/__        __|-|__        '. ___ .'    
       (00)           (o o)          (0~0)        '  (> <) '    
---nn-(o__o)-nn---ooO--(_)--Ooo--ooO--(_)--Ooo---ooO--(_)--Ooo---
http://libspf.org -- ANSI C Sender Policy Framework library
http://libsrs.org -- ANSI C Sender Rewriting Scheme library
-----------------------------------------------------------------
PGP: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x7A7C7DCF

-------
Sender Policy Framework: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
http://www.InboxEvent.com/?s=d --- Inbox Event Nov 17-19 in Atlanta features 
SPF and Sender ID.
To unsubscribe, change your address, or temporarily deactivate your 
subscription, 
please go to 
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com

signature.asc
Description: This is a digitally signed message part