IETF Logo Mail Archive

Re: [dane] DANE and STARTTLS - indication of availability of encryption

James Cloos <cloos@jhcloos.com> Sat, 07 September 2013 02:15 UTC

Return-Path: <cloos@jhcloos.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44B1421F9BF1 for <dane@ietfa.amsl.com>; Fri, 6 Sep 2013 19:15:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.715
X-Spam-Level:
X-Spam-Status: No, score=-1.715 tagged_above=-999 required=5 tests=[AWL=0.884, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jxw527Mvq5ww for <dane@ietfa.amsl.com>; Fri, 6 Sep 2013 19:15:53 -0700 (PDT)
Received: from ore.jhcloos.com (ore.jhcloos.com [198.147.23.85]) by ietfa.amsl.com (Postfix) with ESMTP id AB22921F9C0D for <dane@ietf.org>; Fri, 6 Sep 2013 19:15:52 -0700 (PDT)
Received: by ore.jhcloos.com (Postfix, from userid 10) id 9DB411DFCD; Sat, 7 Sep 2013 02:14:57 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jhcloos.com; s=ore13; t=1378520122; bh=+fj3omk5Xn5b+b3nHuCaEHF3SHB3HNn5JoKwyd1orZA=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=RQTczK5ZcFFaqnRAF5ha7qC1EliK2NBUske0jEFxeSPyAIpm0BBBCSRuHSh23GcKq Gjh1oXpEvP+/CS+uIRsV3/KMuO8Hj35UgKx8fAa9TkoZIXlXzDH/lBy97iYYtYT+vF 1NHlnP37N4EypXeSOfNc2pg4zF9fph9UC9b7SUVQrFg==
Received: by carbon.jhcloos.org (Postfix, from userid 500) id 62F0E6001D; Sat, 7 Sep 2013 02:12:38 +0000 (UTC)
From: James Cloos <cloos@jhcloos.com>
To: Viktor Dukhovni <viktor1dane@dukhovni.org>
In-Reply-To: <20130906155016.GY29796@mournblade.imrryr.org> (Viktor Dukhovni's message of "Fri, 6 Sep 2013 15:50:16 +0000")
References: <20130904144549.GA29796@mournblade.imrryr.org> <m3bo48885q.fsf@carbon.jhcloos.org> <20130905010924.GM29796@mournblade.imrryr.org> <CAF4kx8fq2oxNK2MiCCrNJUn-Qog+TXrHZ+ohj-vKFxpi+5PPEw@mail.gmail.com> <20130905212933.GI61351@mx1.yitter.info> <CAF4kx8etOjE8y4B9dq1dm6_5_8TOYHnp4v1r0bfT1SOr5im0mw@mail.gmail.com> <m3d2om5bt2.fsf@carbon.jhcloos.org> <20130906155016.GY29796@mournblade.imrryr.org>
User-Agent: Gnus/5.130008 (Ma Gnus v0.8) Emacs/24.3.50 (gnu/linux)
Face: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAgMAAABinRfyAAAACVBMVEX///8ZGXBQKKnCrDQ3 AAAAJElEQVQImWNgQAAXzwQg4SKASgAlXIEEiwsSIYBEcLaAtMEAADJnB+kKcKioAAAAAElFTkSu QmCC
Copyright: Copyright 2013 James Cloos
OpenPGP: ED7DAEA6; url=http://jhcloos.com/public_key/0xED7DAEA6.asc
OpenPGP-Fingerprint: E9E9 F828 61A4 6EA9 0F2B 63E7 997A 9F17 ED7D AEA6
Date: Fri, 06 Sep 2013 22:12:38 -0400
Message-ID: <m3sixh4bww.fsf@carbon.jhcloos.org>
Lines: 20
MIME-Version: 1.0
Content-Type: text/plain
X-Hashcash: 1:28:130907:viktor1dane@dukhovni.org::7YJdZB1vTutTDCYc:0000000000000000000000000000000000004C3Od
X-Hashcash: 1:28:130907:dane@ietf.org::n3x0vWP3GcmRNu3t:000Vm0VM
Cc: dane@ietf.org
Subject: Re: [dane] DANE and STARTTLS - indication of availability of encryption
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Sep 2013 02:15:57 -0000

>>>>> "VD" == Viktor Dukhovni <viktor1dane@dukhovni.org> writes:

VD> On Fri, Sep 06, 2013 at 09:17:20AM -0400, James Cloos wrote:
>> The idea of using the existence of an unsecured tlsa rr as a hint that
>> tls must be used was, IIRC, discussed in the early days of this wg.

VD> This is largely impractical for SMTP.  SMTP TLSA RRs are of course
VD> tied to MX hosts (transport destinations), not email domains.  An
VD> MITM can bypass any such cached RRs by sending malicious MX replies.

I was noting history above, not advocating.

I also wrote the the wg consensus was against using unsecured TLSA (or
other new RRs) for anything.

I always preferred dnssec-for-everything-dane.

-JimC
-- 
James Cloos <cloos@jhcloos.com>         OpenPGP: 1024D/ED7DAEA6

v2.30.2 | Report a Bug | By Email | System Status