IETF Logo Mail Archive

Re: [dane] review of draft-ietf-dane-smtp-with-dane-02.txt

James Cloos <cloos@jhcloos.com> Wed, 06 November 2013 13:35 UTC

Return-Path: <cloos@jhcloos.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0F3711E81AC for <dane@ietfa.amsl.com>; Wed, 6 Nov 2013 05:35:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oHBwTS+74v42 for <dane@ietfa.amsl.com>; Wed, 6 Nov 2013 05:35:35 -0800 (PST)
Received: from ore.jhcloos.com (ore.jhcloos.com [IPv6:2604:2880::b24d:a297]) by ietfa.amsl.com (Postfix) with ESMTP id 2825311E81A9 for <dane@ietf.org>; Wed, 6 Nov 2013 05:35:35 -0800 (PST)
Received: by ore.jhcloos.com (Postfix, from userid 10) id D536B1E107; Wed, 6 Nov 2013 13:35:32 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jhcloos.com; s=ore13; t=1383744932; bh=zuUdVPUmzoPVsOkB9QsFVhw4RrXU6Od3kRZwBwm4J6U=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=ZlujqlZl30hgdQ7wf4JWxX9r9AVyhDDID56W9MxxPMeGVh9n31svmGAtv09HgtreK FhIuu5peppqR95GprBxNbncIYLnadeJKFH8jJaeDvCWPnxQk+aPLgS15jEPFIWmm4x 6jSbqbG/6/PvkSr1r6doGzBjT6bWc2mhGEjt2PQwjdQ==
Received: by carbon.jhcloos.org (Postfix, from userid 500) id D3C1A60022; Wed, 6 Nov 2013 13:33:14 +0000 (UTC)
From: James Cloos <cloos@jhcloos.com>
To: dane@ietf.org
In-Reply-To: <789202E67F7415FC98D8FECF@96B2F16665FF96BAE59E9B90> (Chris Newman's message of "Tue, 05 Nov 2013 17:01:54 -0800")
References: <789202E67F7415FC98D8FECF@96B2F16665FF96BAE59E9B90>
User-Agent: Gnus/5.130008 (Ma Gnus v0.8) Emacs/24.3.50 (gnu/linux)
Face: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAgMAAABinRfyAAAACVBMVEX///8ZGXBQKKnCrDQ3 AAAAJElEQVQImWNgQAAXzwQg4SKASgAlXIEEiwsSIYBEcLaAtMEAADJnB+kKcKioAAAAAElFTkSu QmCC
Copyright: Copyright 2013 James Cloos
OpenPGP: ED7DAEA6; url=http://jhcloos.com/public_key/0xED7DAEA6.asc
OpenPGP-Fingerprint: E9E9 F828 61A4 6EA9 0F2B 63E7 997A 9F17 ED7D AEA6
Date: Wed, 06 Nov 2013 08:33:14 -0500
Message-ID: <m361s5odsc.fsf@carbon.jhcloos.org>
Lines: 19
MIME-Version: 1.0
Content-Type: text/plain
X-Hashcash: 1:28:131106:dane@ietf.org::3S/aKZ7tQtYXo8+g:000L/eDx
X-Hashcash: 1:28:131106:chris.newman@oracle.com::C0qOTLK19q3BJDwk:0000000000000000000000000000000000000G6bKw
Subject: Re: [dane] review of draft-ietf-dane-smtp-with-dane-02.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Nov 2013 13:35:35 -0000

>>>>> "CN" == Chris Newman <chris.newman@oracle.com> writes:

CN> *2* I believe it's undesirable to attempt to deploy DANE TLSA for
CN> submission services (port 587 or de-facto port 465) 

TLSA SHOULD be checked for *all* TLS connections by clients.  We should
not have any RFCs which try to exempt certain ports, nor recommend
avoiding DANE for certain ports or services.

We want the TLS libraries to implement it (as gnutls has done) and for
applications to take advantage of DANE whenever they initiate TLS sockets.

The only real question is what to do when provided just an ip address.
Should the TLSA be checked in arpa., or should it look under the name
returned by a PTR lookup?

-JimC
-- 
James Cloos <cloos@jhcloos.com>         OpenPGP: 1024D/ED7DAEA6

v2.23.0 | Report a Bug | By Email