Deprecation of RSA-SHA-1 in DKIM keys? I recently noticed that OpenDKIM on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation anyone?) but I also noticed that the signing algorithm is shown as a=rsa-sha1, and with the move to “Deprecate SHA-1” in other contexts, I'm wondering: how urgent this is for DKIM?

It is now feasible to brute-force SHA-1 hashes. Am I correct in thinking that this would need to be done for each message an attacker wished to forge the signature for, without being able to re-use that work for the next message?
It may be that that's due to lack of secure DNS (confirmation anyone?)


So it turned out to likely be a warning about lack of DNS security.


  I also noticed that the signing algorithm is shown as a=rsa-sha1, and with the move to “Deprecate SHA-1” in other contexts, I'm wondering: how urgent this is for DKIM?


Not very urgent. Current attacks only put a dent in SHA-1 collision resistance, which requires generating a large number of messages to find a pair with equal hash values. That is only a concern whenever the attacker can both predict the data to be signed and influence some of it.

Typically, with DKIM an attacker can't get such a message signed. If you send an arbitrary message that gets signed by the domain, the attacker would need a second preimage attack to forge a change. The second preimage resistance of SHA-1 is still close enough to the expected $2^{160}$ to be completely unbreakable with current attacks.

There may be special cases where a collision attack could be possible, like if the attacker has access to an email account on a domain, but the messages are screened for spam before being sent. Then they could look for a pair of messages where one is innocent, the other spam; send the legitimate message; and copy the signature to the spam message. In this case the attacker would have to predict any header fields and the like that DKIM signs, so feasibility would depend on the setup.

Even if a collision attack was possible, it would take quite a lot of computational effort ($2^{61}$ or so).


  Am I correct in thinking that this would need to be done for each message an attacker wished to forge the signature for, without being able to re-use that work for the next message?


Finding multiple collisions is not that much harder than finding one. A generic preimage attack also becomes easier the more target messages you have. So the attacker could probably share some work if an attack was possible in the first place. However, it's not a key recovery attack, so every new forgery would need more work, yes.