Re: [dane] [[e-mail]] New Version Notification for draft-dukhovni-dane-ops-01.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Jul 26, 2013 at 02:19:26PM -0700, Trevor Perrin wrote:

> > Until recently I was the postmaster of a site with O(100) such
> > manual TLS policies,  each one was a pain to setup (30minutes of
> > conf call with the peer site's email admins) and the resulting
> > static configurations were fragile.
> 
> That's pretty interesting, I didn't know there was SMTP manual pinning
> on that scale.  If you don't mind sharing, I'm curious:
>
>  - Can you configure TLS pins on common mail servers?

Postfix supports a "fingerprint" security level, but in most cases, the
manual security arrangements used PKIX with hand-crafted name checks.
So we did not often "pin" certificates with outside parties, such pins
were only used from time to time on SMTP links where we controlled the
certificates on both ends.

>  - Is this a common practice?
>  - Are there any efforts at aggregating and sharing pin lists,
> so they don't need pairwise phone calls?

Yes, there was an industry effort to aggregate TLS configuration
data, but it never went very far.  I am hoping DANE will obviate
the need for this, provided we can get people to adopt DNSSEC.

> FWIW, the way we saw cross-domain SMTP working for TACK was:  If the
> sending MTA indicates TACK support in its TLS ClientHello, the
> receiving MTA could return a "tack", and the sender could activate a
> pin between the TACK Signing Key and the email recipient's domain
> name.  (NOT the mailserver's name - this would be special cross-domain
> SMTP semantics).

I don't think this is practical for SMTP.  My focus is on DANE.

-- 
	Viktor.