[Top] [All Lists]

Re: [ietf-smtp] Fwd: New Version Notification for draft-fenton-smtp-require-tls-00.txt

2016-01-11 11:49:55
I'm a nasty and motivated attacker who has compromised part of
either your LAN or the WAN ...
If you want a cert bound to that address,
I can make one up and send it to you.

Now, one could further harden that by making DNS records that
identified, e.g., the CA that would be required to sign any
certs or records from the address.  My skimming of 7672 suggests
it doesn't go that far.

Ah, but it does. That's what the TLSA record is. It has too many options (being after all a recent product of the IETF) but it can contain a hash of the certificate itself, or a hash of the CA signing certificate that the SMTP server has to offer when it does the STARTTLS.

Experience with the variable quality of coordination and cooperation between mail server operators and DNS operators in organizations large enough to have them be separate functions suggests that level of linkage will lead to a lot of false negatives and unnecessary rejections, but maybe that is a different matter.

I wouldn't disagree, but if you want a path for your mail that prevents MITM, it's hard to see how to make it any simpler. This is the same issue that DANE has had all along, that the people who understand DNS and who manage DNS are often not the ones who manage whatever applications are using certificates. It's only been in the past couple of weeks that there's even been a beta version of openssl that can check DANE certs.

John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

ietf-smtp mailing list

<Prev in Thread] Current Thread [Next in Thread>