IETF Logo Mail Archive

Re: [ietf-smtp] [OT] (signed TLDs)

Arnt Gulbrandsen <arnt@gulbrandsen.priv.no> Tue, 15 October 2019 19:11 UTC

Return-Path: <arnt@gulbrandsen.priv.no>
X-Original-To: ietf-smtp@ietfa.amsl.com
Delivered-To: ietf-smtp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1148F120819 for <ietf-smtp@ietfa.amsl.com>; Tue, 15 Oct 2019 12:11:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gulbrandsen.priv.no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i6l6Bc70PeG6 for <ietf-smtp@ietfa.amsl.com>; Tue, 15 Oct 2019 12:11:00 -0700 (PDT)
Received: from stabil.gulbrandsen.priv.no (stabil.gulbrandsen.priv.no [IPv6:2a01:4f8:191:91a8::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05A3F120887 for <ietf-smtp@ietf.org>; Tue, 15 Oct 2019 12:10:52 -0700 (PDT)
Received: from stabil.gulbrandsen.priv.no (stabil.gulbrandsen.priv.no [IPv6:2a01:4f8:191:91a8::3]) by stabil.gulbrandsen.priv.no (Postfix) with ESMTP id 66446C0074; Tue, 15 Oct 2019 20:14:24 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gulbrandsen.priv.no; s=mail; t=1571166864; bh=DT7MiRgtgHzpikXsFgN2x/AkZd2w6odPojdWuNg3A1Y=; h=From:To:Subject:Date:In-Reply-To:References:From; b=GIxYzixzc632BTfIXgsqqrSBqZLAkwQmIcuDQq6tNLBIbmHLnUvx7OX4MWfLy6V+h 4EDSgbiXymzIJRZ2rww+P4CYXLwfIOUjzcFwJVcfujBuU1cOQsuvf2nZKjjUU5fNmO LuoA1j4tHyNfHuKQuETvz2gxgMrfdSCEz09Wazjk=
Received: from arnt@gulbrandsen.priv.no by stabil.gulbrandsen.priv.no (Archiveopteryx 3.2.0) with esmtpsa id 1571166863-27258-27256/9/46; Tue, 15 Oct 2019 19:14:23 +0000
From: Arnt Gulbrandsen <arnt@gulbrandsen.priv.no>
To: ietf-smtp@ietf.org
Date: Tue, 15 Oct 2019 21:10:47 +0200
Mime-Version: 1.0
Message-Id: <4667cc53-63cd-4cd1-97a5-80a4f7f28fad@gulbrandsen.priv.no>
In-Reply-To: <5DA5F942.5030307@isdg.net>
References: <20191011160802.50C81C9B780@ary.qy> <alpine.DEB.2.20.1910141200120.8949@grey.csi.cam.ac.uk> <alpine.OSX.2.21.99999.368.1910141020460.72467@ary.local> <alpine.DEB.2.20.1910151228410.8949@grey.csi.cam.ac.uk> <5DA5F942.5030307@isdg.net>
User-Agent: Trojita/0.7; Qt/5.7.1; xcb; Linux; Devuan GNU/Linux 2.0 (ascii)
Content-Type: text/plain; charset="utf-8"; format="flowed"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-smtp/51_ZpRVaBS_5gXZN5lRHRCz7GgU>
Subject: Re: [ietf-smtp] [OT] (signed TLDs)
X-BeenThere: ietf-smtp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Discussion of issues related to Simple Mail Transfer Protocol \(SMTP\) \[RFC 821, RFC 2821, RFC 5321\]" <ietf-smtp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf-smtp/>
List-Post: <mailto:ietf-smtp@ietf.org>
List-Help: <mailto:ietf-smtp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Oct 2019 19:11:02 -0000

On Tuesday 15 October 2019 18:52:18 CEST, Hector Santos wrote:
> I wish I understood more of this discussion and "basic 
> problem," if any,

It's this: if someone were to tell the .com registry that starting 
immediately, they wish to sign domain hsantos.com and will the .com 
registry please include the necessary RRs in .com, how would the .com 
registry know whether to trust that someone?

Once the domain is signed and the records are in .com, there's a fine 
mechanism that anyone can use to check whether that someone actually 
controls hsantos.com. But what about the initial inclusion of the 
signature-related records in the .com zone?

There are ways, sometimes at least. For example, if it's done when the 
domain is initially registered, then it's clear that the registrant 
actually is the registrant. But initiating trust is a difficult problem if 
you want to solve it generally.

Arnt

v2.23.0 | Report a Bug | By Email