KeyForge: Mitigating Email Breaches with Forward-Forgeable Signatures
This addresses email security for users by mitigating breach impacts, though it is incremental as it builds on existing DKIM protocols.
The paper tackles the problem of email breaches where stolen emails can be authenticated by attackers, exacerbating reputational damage and blackmail, by introducing non-attributable email systems like KeyForge that prevent adversaries from proving authenticity to third parties while maintaining anti-spam protections, with KeyForge showing practical implementation requiring 42% less bandwidth than RSA2048.
Email breaches are commonplace, and they expose a wealth of personal, business, and political data that may have devastating consequences. The current email system allows any attacker who gains access to your email to prove the authenticity of the stolen messages to third parties -- a property arising from a necessary anti-spam / anti-spoofing protocol called DKIM. This exacerbates the problem of email breaches by greatly increasing the potential for attackers to damage the users' reputation, blackmail them, or sell the stolen information to third parties. In this paper, we introduce "non-attributable email", which guarantees that a wide class of adversaries are unable to convince any third party of the authenticity of stolen emails. We formally define non-attributability, and present two practical system proposals -- KeyForge and TimeForge -- that provably achieve non-attributability while maintaining the important protection against spam and spoofing that is currently provided by DKIM. Moreover, we implement KeyForge and demonstrate that that scheme is practical, achieving competitive verification and signing speed while also requiring 42% less bandwidth per email than RSA2048.