KeyForge: Mitigating Email Breaches with Forward-Forgeable Signatures

TL;DR

This paper introduces KeyForge, a practical email signing scheme that prevents attackers from proving stolen emails' authenticity, enhancing privacy and security beyond current standards like DKIM.

Contribution

It proposes the novel concept of non-attributability for email signatures and presents two practical schemes, KeyForge and TimeForge, that achieve this while maintaining spam protection.

Findings

KeyForge is practical with competitive speed.

KeyForge requires 42% less bandwidth than RSA2048.

The schemes provably achieve non-attributability.

Abstract

Email breaches are commonplace, and they expose a wealth of personal, business, and political data that may have devastating consequences. The current email system allows any attacker who gains access to your email to prove the authenticity of the stolen messages to third parties -- a property arising from a necessary anti-spam / anti-spoofing protocol called DKIM. This exacerbates the problem of email breaches by greatly increasing the potential for attackers to damage the users' reputation, blackmail them, or sell the stolen information to third parties. In this paper, we introduce "non-attributable email", which guarantees that a wide class of adversaries are unable to convince any third party of the authenticity of stolen emails. We formally define non-attributability, and present two practical system proposals -- KeyForge and TimeForge -- that provably achieve non-attributability while maintaining the important protection against spam and spoofing that is currently provided by DKIM. Moreover, we implement KeyForge and demonstrate that that scheme is practical, achieving competitive verification and signing speed while also requiring 42% less bandwidth per email than RSA2048.