Oops... Forgot to include the proposal document link.
https://gist.github.com/mistergiri/a4c9a5f1c26fd7003ebc0652af95d314
Sorry about that.
On Mon, Jan 7, 2019 at 1:55 PM Viruthagiri Thirumavalavan
<giri(_at_)dombox(_dot_)org>
wrote:
Hello Everyone,
I have proposal for SMTPS. Already gathered some feedback from UTA working
group and improved my draft.
My proposal is a very simple document. So, please go though it and give
me feedback if you can.
Here is my abstract.
---------
SMTP is still suffering from downgrade attacks like STRIPTLS. While we
have "Opportunistic TLS", we still don't have "Implicit TLS" in the SMTP.
Don't get me wrong. We do have "Implicit TLS" for "SMTP Submission" on port
465. But we don't have a secure port 25 alternative. i.e. The real SMTPS
Both MTA-STS and MTA-DANE tries to fix the STARTTLS downgrade issue.
However the implementation is not simple. The former requires a HTTPS
server and the latter requires DNSSEC.
This document propose a new port 26, an "Implicit TLS" alternative for
port 25 and recommends the MX server to signal the port via a prefix.
e.g. mx1.example.com should be prefixed like smtps-mx1.example.com.
Where "smtps-" says "We prefer if you connect to our SMTPS in port 26. But
we also accept mails in port 25. And our port 25 supports Opportunistic
TLS. So if STARTTLS command not found in the EHLO response or certificate
is invalid, then drop the connection".
--------
Thanks
--
Best Regards,
Viruthagiri Thirumavalavan
Dombox, Inc.
--
Best Regards,
Viruthagiri Thirumavalavan
Dombox, Inc.
_______________________________________________
ietf-smtp mailing list
ietf-smtp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf-smtp