Skip to content

DKIM doesn't validate signatures with i18n characters in some cases #77

@wttw

Description

@wttw

Given a DKIM signature something like this one ...

DKIM-Signature: v=1; d=exampl.com; s=banana;
 a=rsa-sha256; q=dns/txt; t=1758184992; c=relaxed/simple;
 h=Date:To:From:Subject:Message-ID:X-Mailer:MIME-Version:Content-Type;
 z=Date:Thu,=2018=20Sep=202025=2010:43:12=20+0200
 |To:Steve=20Example=20<steve@example.com>
 |From:=3D?iso-8859-1?Q?Steve_A=3DE6r=3DF8b=3DE5d?=3D=20<test@example.com>
 |Subject:Testing=20e-mail=20delivery=20-=20
 |Message-ID:<2XHGoCCQWzl8qMiFxROga9hoRk27Sudtpz7anqmHw@do.mcnally.dk>
 |MIME-Version:1.0
 |Content-Type:multipart/alternative=3B=20boundary=3D"b1_2XHGoCCQWzl8qMiFxR
 Oga9hoRk27Sudtpz7anqmHw";
 bh=rQbaGWU+E5hro2qduBd5Ip6T/Cw+iAR9SUe+JONP2Qg=;
 b=WcFdMG/frqHUr0JsiGnP7BIDIbEDBSNZu9xTiojagO9Qfx3Dgh7suf+ozGsG/zz061e8rlgVp
 NvA+I+HN1KKMDnmi7HCkafYlvvW8ziUMZTHrZk7D0AkGFZ4GNvMbBSumAIM3PSZ+RwQcgE7GQ
 59AkncvTKqRUOuvUV5zDB2WBY=

.. validation will fail with "signature did not verify: crypto/rsa: verification error".

What's happening is that the removeSignature() function uses a regexp (b\s*=)[^;]+ to remove the body of the b= tag. That regexp matches several things in the header, including the "b=3D" Q-encoded content in the subject line included in the z= field and deletes to the end of the field in each case. That leads to the hash being wrong and the verification fails.

It looks like a relatively simple fix. I'll take a look at a PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions