Re: [Acme] Last Call: <draft-ietf-acme-email-smime-08.txt> (Extensions to Automatic Certificate Mana

On 25/06/2020 22:40, Sebastian Nielsen wrote:

> 1: Of course DKIM can be used to validate the authenticity of the email such
> as it has been sent from the specified domain.

Right. And the list of header fields to sign in case DKIM is used 
protects most important header fields that must not be tempered with.

> 2: Validation response messages should NOT be forwarded! Normally, you would
> send a response message like from sebastian@sebbe.eu to
> certvalidate@ca.example.org
> Of course, if ca.example.org is in full control of all email servers, they
> can easily do the validation at the leaf server ca.example.org, and then
> forward the email message to a internal server for SMIME issuance, for
> example by adding a encrypted and signed header with the validation, or
> communicating out-of-band - for example with a MySQL server, that the
> message X is propely SPF and DKIM validated.
>
> The type of forwarding SPF don't work with, would be if
> certvalidate@ca.example.org was forwarded to lets say
> suspicious.ca@gmail.com then if I send a validation reponse to
> certvalidate@ca.example.org from sebastian@sebbe.eu , validation would fail
> @ GMAIL when they receive the message from ca.example.org which is a server
> not on my authorization list.
>
> And a CA running an email server that forwards to an server they are not in
> full control of, is a HUGE security risk for SMIME issuance - unless they
> have proper agreements in place - for example a subCA that forwards their
> validations to the main CA, but still want a "branded" email adress for
> their ACME validations - but then their agreements could easily include that
> the subCA should do the validations at the leaf server, and then add
> information to the email that allows the main CA to see that SPF and DKIM
> was propely validated.
> Or include the client IP in the message, signed securely, so the main CA can
> validate SPF.

I basically agree with this.

> -----Ursprungligt meddelande-----
> Från: acme-bounces@ietf.org <acme-bounces@ietf.org> För S Moonesamy
> Skickat: den 25 juni 2020 21:59
> Till: Alexey Melnikov <alexey.melnikov@isode.com>
> Kopia: rdd@cert.org; acme@ietf.org; draft-ietf-acme-email-smime@ietf.org;
> acme-chairs@ietf.org
> Ämne: Re: [Acme] Last Call: <draft-ietf-acme-email-smime-08.txt> (Extensions
> to Automatic Certificate Mana
>
> Hi Alexey,
> At 11:57 AM 25-06-2020, The IESG wrote:
>> The IESG has received a request from the Automated Certificate
>> Management Environment WG (acme) to consider the following document: -
>> 'Extensions to Automatic Certificate Management Environment for end
>>     user S/MIME certificates'
>>    <draft-ietf-acme-email-smime-08.txt> as Proposed Standard
>>
>> The IESG plans to make a decision in the next few weeks, and solicits
>> final comments on this action. Please send substantive comments to the
> In Section 3.1, there is the following in Point 3 and 5: "The message MAY
> contain Reply-To header field."  Is the duplication a mistake?
>
> Point 6 states that its purpose is to "prove authenticity of a challenge
> message".  How does DKIM prove authenticity [1]?
>
> Why is there a requirement that the message has to pass DMARC validation?
> Has forwarding been taken into account [2]?
>
> Regards,
> S. Moonesamy
>
> 1. Please see Section 5.4 of RFC 6376.
> 2. That does not work well with SPF.
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme
>