[dkim-milter-discuss] RSA_verify: bad signature

Discussion:

Simon Bell

2010-04-30 16:25:41 UTC

Hi, I am running postfix with dkim-milter. I sign out-going mail and
verify incoming. When my mail server receives from google or yahoo,
all seems to be fine, I get:
--
dkim-filter: DKIM verification successful
--
But mail from 'bluebottle' email gives me this error:
--
dkim-filter: DKIM verification successful
dkim-filter: s=fe0 d=bluebottle[dot]com SSL error:04077068:rsa
routines:RSA_verify:bad signature
--

Could someone help me understand what the error means and if it is
something wrong with my server?

Thank you

Robert Schetterer

2010-07-07 09:22:37 UTC

Permalink

Post by Simon Bell
Hi, I am running postfix with dkim-milter. I sign out-going mail and
verify incoming. When my mail server receives from google or yahoo,
--
dkim-filter: DKIM verification successful
--
--
dkim-filter: DKIM verification successful
dkim-filter: s=fe0 d=bluebottle[dot]com SSL error:04077068:rsa
routines:RSA_verify:bad signature
--
Could someone help me understand what the error means and if it is
something wrong with my server?
Thank you
------------------------------------------------------------------------------
_______________________________________________
dkim-milter-discuss mailing list
https://lists.sourceforge.net/lists/listinfo/dkim-milter-discuss

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

--
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria

Scott Kitterman

2010-07-07 14:03:01 UTC

Permalink

Post by Robert Schetterer

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

For Ubuntu Lucid, I would recommend switching to opendkim. Unlike dkim-milter, this fork is actively maintained and has some significant bug fixing beyond what was ever done for dkim-milter.

I've done the switch on several systems and it's pretty trivial .

Scott K

Murray S. Kucherawy

2010-07-07 16:07:40 UTC

Permalink

-----Original Message-----
Sent: Wednesday, July 07, 2010 2:23 AM
Subject: Re: [dkim-milter-discuss] RSA_verify: bad signature

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

No idea about xing.com, but Bluebottle definitely had a bug in its signing code that would give false negatives if the message went to two recipients. Perhaps xing.com is having a similar issue.

Robert Schetterer

2010-07-08 08:21:52 UTC

Permalink

Post by Murray S. Kucherawy

-----Original Message-----
Sent: Wednesday, July 07, 2010 2:23 AM
Subject: Re: [dkim-milter-discuss] RSA_verify: bad signature

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

No idea about xing.com, but Bluebottle definitely had a bug in its signing code that would give false negatives if the message went to two recipients. Perhaps xing.com is having a similar issue.

hm so no bug is known currently ...with this version ?
so you maybe right with wrong signings

Post by Murray S. Kucherawy
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
dkim-milter-discuss mailing list
https://lists.sourceforge.net/lists/listinfo/dkim-milter-discuss

Joerg Dorchain

2010-07-08 11:22:04 UTC

Permalink

Post by Murray S. Kucherawy

Post by Robert Schetterer

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

No idea about xing.com, but Bluebottle definitely had a bug in its signing
code that would give false negatives if the message went to two recipients.
Perhaps xing.com is having a similar issue.

xing.com signs the X-Virus-* headers, too. Those tend to be
overwritten by any spam- or viruscheckers on the way. I had a conversation
with them, they think that this is a great idea because it
prooves their checks are trustworthy or so.
My hint to rfc and best practices were considered unqualified.

Maybe somebody else with higher diplomatic skills wants to talk
to them on this matter.

Bye,

Joerg

Robert Schetterer

2010-07-08 11:56:49 UTC

Permalink

Post by Joerg Dorchain

Post by Murray S. Kucherawy

Post by Robert Schetterer

got the same now for i.e xing.com under ubuntu lucid
v2.8.3 running in only verify mode
someone any ideas ?

No idea about xing.com, but Bluebottle definitely had a bug in its signing
code that would give false negatives if the message went to two recipients.
Perhaps xing.com is having a similar issue.

xing.com signs the X-Virus-* headers, too. Those tend to be
overwritten by any spam- or viruscheckers on the way. I had a conversation
with them, they think that this is a great idea because it
prooves their checks are trustworthy or so.
My hint to rfc and best practices were considered unqualified.
Maybe somebody else with higher diplomatic skills wants to talk
to them on this matter.
Bye,
Joerg

oh oh, thx for info, i expected something like that

Post by Joerg Dorchain
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
dkim-milter-discuss mailing list
https://lists.sourceforge.net/lists/listinfo/dkim-milter-discuss

--
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria