Re: [dane] I-D Action: draft-ietf-dane-smime-03.txt

"Jim Schaad" <ietf@augustcellars.com> Fri, 07 February 2014 01:14 UTC

Return-Path: <ietf@augustcellars.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F0A81A058E for <dane@ietfa.amsl.com>; Thu, 6 Feb 2014 17:14:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uNiafuAA-x6H for <dane@ietfa.amsl.com>; Thu, 6 Feb 2014 17:13:59 -0800 (PST)
Received: from smtp3.pacifier.net (smtp3.pacifier.net [64.255.237.177]) by ietfa.amsl.com (Postfix) with ESMTP id 8FC171A0585 for <dane@ietf.org>; Thu, 6 Feb 2014 17:13:59 -0800 (PST)
Received: from Philemon (50-39-223-207.bvtn.or.frontiernet.net [50.39.223.207]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp3.pacifier.net (Postfix) with ESMTPSA id 2B2DA38EF3 for <dane@ietf.org>; Thu, 6 Feb 2014 17:13:58 -0800 (PST)
From: "Jim Schaad" <ietf@augustcellars.com>
To: <dane@ietf.org>
References: <41938fd202ba460285b59132c29ac826@BY2PR09MB029.namprd09.prod.outlook.com> <20140206195322.GD278@mournblade.imrryr.org> <11698F58-B554-4CC8-872F-D2A3BF08986C@kirei.se> <20140206215742.GF278@mournblade.imrryr.org>
In-Reply-To: <20140206215742.GF278@mournblade.imrryr.org>
Date: Thu, 6 Feb 2014 17:12:18 -0800
Message-ID: <07a801cf23a1$a5b62c00$f1228400$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQG9BCk5y8KpLGv7J7/0RgkJHs14wAMI8/6lAgOPaNIB7rzTBpqVYLvg
Content-Language: en-us
Subject: Re: [dane] I-D Action: draft-ietf-dane-smime-03.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Feb 2014 01:14:01 -0000

> -----Original Message-----
> From: dane [mailto:dane-bounces@ietf.org] On Behalf Of Viktor Dukhovni
> Sent: Thursday, February 06, 2014 1:58 PM
> To: dane@ietf.org
> Subject: Re: [dane] I-D Action: draft-ietf-dane-smime-03.txt
> 
> On Thu, Feb 06, 2014 at 10:51:28PM +0100, Jakob Schlyter wrote:
> 
> > On 6 feb 2014, at 20:53, Viktor Dukhovni <viktor1dane@dukhovni.org>
> wrote:
> >
> > > Switching gears, was any consensus reached on the endoing of the
> > > query label?  A truncated HMAC seems to offer better usability than
> > > base32.  I think that the specification is in good shape, modulo the
> > > query label encoding.
> >
> > Yes, we're looking at doing a plain sha224 for the LHS lookup instead
> > of base32. Paul Wouters will provide some draft text for both
> > documents (S/MIME & PGP). I would [not] say we have consensus for
> > HMAC-sha224 yet, but that's something we can discuss further.
> 
> I think that HMAC-sha224 would be wiser, since otherwise a single
dictionary
> works for all domains.  The key should be the domain name.  The question
is I
> think not whether HMAC is necessary, but rather whether it is sufficient,
one
> might argue for iterated HMAC with a reasonably high iteration count
> (unfortunately fixed, but Moore's law will end any day now, ... promise! )

A trivial way to avoid the global dictionary is to simply hash the email
address - that is both the local part and the domain.  This would make it
unique for each domain.

Jim

> 
> --
> 	Viktor.
> _______________________________________________
> dane mailing list
> dane@ietf.org
> https://www.ietf.org/mailman/listinfo/dane