Re: [dane] Feature creep for draft-ietf-dane-smime

[Viktor Dukhovni <[e-mail]>]

On Thu, Feb 06, 2014 at 05:26:55PM -0800, Paul Hoffman wrote:

> Why are we trying to make the names any more difficult to walk
> through than they would be for SMTP? The use of the hash was *purely*
> to allow longer LHSs, not to prevent enumeration. Enumeration has
> never been considered a serious problem for SMTP, and we should
> not be complicating our protocol to prevent it. Hash-of-LHS is
> simple and not prone to any misunderstanding.

SMTP does not yield an efficient offline attack.  There exist
popular milters that attempt to thwart "directory harvesting
attacks".

Once there's a hash, it should at least (at no extra cost) include
the domain, to make the attack require per-domain computations.

However, what I forgot to take into account is that with DNSSEC
what the attacker learns are the NSEC3 hashes of the email address
query domain, so a single dictionary is already not an option
because the NSEC3 RRs need to be cracked and these are already
salted with the domain and additional salt value.

So the offline attack is already a per-domain attack even without
salting of the hashed label.  Thus perhaps including the domain is
not essential (but no reason not to).  What could offer much better
protection is O(100,000) iterations (i.e., O(0.1) CPU second to
compute a lookup key).  An interactive user may not notice, but a
legititmate bulk email engine sending encrypted mail may run into
noticeable latency.

I am not strongly advocating for this, more thinking out loud, in
case the issue resonates with the group.

-- 
	Viktor.