Re: [dane] [[e-mail]] New Version Notification for draft-dukhovni-dane-ops-01.txt

[Trevor Perrin <[e-mail]>]

Hi Victor, all,

Don't mean to derail discussion but I heard the word pinning... :-)

> Until recently I was the postmaster of a site with O(100) such
> manual TLS policies,  each one was a pain to setup (30minutes of
> conf call with the peer site's email admins) and the resulting
> static configurations were fragile.

That's pretty interesting, I didn't know there was SMTP manual pinning
on that scale.  If you don't mind sharing, I'm curious:
 - Can you configure TLS pins on common mail servers?
 - Is this a common practice?
 - Are there any efforts at aggregating and sharing pin lists, so they
don't need pairwise phone calls?

FWIW, the way we saw cross-domain SMTP working for TACK was:  If the
sending MTA indicates TACK support in its TLS ClientHello, the
receiving MTA could return a "tack", and the sender could activate a
pin between the TACK Signing Key and the email recipient's domain
name.  (NOT the mailserver's name - this would be special cross-domain
SMTP semantics).

This assumes the sending MTA would send the MX hostname in TLS SNI,
and the receiving MTA would use this to determine which certs / tacks
to return.  (Not sure this is workable, but I think DANE SRV [1]
expects to use SNI in a similar way?)

Anyways, aside from this, the MX hostname wouldn't matter for the pin
validation.


Trevor

[1] http://tools.ietf.org/html/draft-ietf-dane-srv-02