On 06/06/2014 04:12 PM, Brandon Long wrote:
Now that more servers are offering STARTTLS, it would seem beneficial
to move forward towards certificate validation.
Before we get too far down the road with how to accomplish this, I'd
like to ask about the "beneficial" part: What behavior we would like to
occur with respect to certificate validation?
Currently, if certificates don't validate correctly for SMTP, most
clients just let the TLS connection complete anyway. This has the
obvious problem with man-in-the-middle attacks, but is effective against
passive attacks.
If this changes, we'd presumably be bouncing messages when the cert
doesn't validate. That might be the right thing to do for some very
sensitive messages, but the vast majority aren't. Email is biased to
favor delivery over security, and our usage assumes that in various ways.
If these messages do bounce, what happens if it isn't possible to
establish a TLS path with validated certificates on the return path?
It's the receiving SMTP server that sets the level of security (pins the
certificate) here, while it's only the SMTP client that could possibly
know what the sensitivity of the message is and therefore how important
that might be -- and we don't have mechanisms to convey that to the SMTP
client either.
I'd like to improve the resistance to MITM attacks, sure -- but I
wouldn't want collateral damage to the bulk of traffic, which doesn't care.
-Jim
_______________________________________________
ietf-smtp mailing list
ietf-smtp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf-smtp