IETF Logo Mail Archive

Re: Why are mail servers not also key servers?

Doug Royer <douglasroyer@gmail.com> Thu, 27 April 2017 04:27 UTC

Return-Path: <douglasroyer@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AADF12EC6B for <ietf@ietfa.amsl.com>; Wed, 26 Apr 2017 21:27:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XV0iNwn7rmJB for <ietf@ietfa.amsl.com>; Wed, 26 Apr 2017 21:27:00 -0700 (PDT)
Received: from mail-oi0-x233.google.com (mail-oi0-x233.google.com [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A913212F29A for <ietf@ietf.org>; Wed, 26 Apr 2017 21:27:00 -0700 (PDT)
Received: by mail-oi0-x233.google.com with SMTP id j201so24683278oih.2 for <ietf@ietf.org>; Wed, 26 Apr 2017 21:27:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:organization:message-id:date:user-agent :mime-version:in-reply-to; bh=9n6gUvowzopOyJcUVGtvnkAoNoZq8CzzU3gKvui6e7Q=; b=KC/A/TwysZYbBFMixk2PqHEAkfQZvYCKufRFdlEwRBUuYpzamZrGmyG6d6SK7mbWKZ KzGXB8ImmZ5nz55Sk5b0BG3EIDzR7FDSTuCLi6GOz8m1DTYXt+9vuH9QnXjPef+MyqjA uvuSf+g3XFwBv+N4uAPR134/rwqTJrBbtfIkZThwMnVgXU7h5zOsueAkaluD94FznbgY rIEnxqf5FchukfWPFWTxduvYfLV4gSzKrXbJRmAtHYdr7f7yphKnWQ0/sTV8R/NzLFJK UkFuUctIUByg59q+U1DJhh8HRur3dSR7/5XGz/u3aW7cm4l2nueJVSppfCr8FYEg3M/x YQgQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to; bh=9n6gUvowzopOyJcUVGtvnkAoNoZq8CzzU3gKvui6e7Q=; b=M+pBIv+/ex6Bbtz0ocyC7dAlJpT528//sB3wPN0bySPTryK0k3wGnorsb3db0EnsFm Aw+dI0bO/+vxOOBZNPrzwruSQL1wcPLW2Swg9Shr5CyOE/UkRY6lTId5+KCaSCI7ghPa lU/Asq87P1p1OESqLYQdmQgCvLu/fCDSw7veuqr17t3i+LzJyeUpaUgOBehiEKNXR6Xn d5hblscEfzad/iXQLCGlk5C9D3ZExOv563w9ts8+5aBTfEPpO2dT62138/Cwao+JRBZ9 5k+SHVZ8r8rtWifucPWxwd+8QNtyKJTDJ0qfsvxMsv35MNrxEZwi8HHTKaf+U2NeGbG4 5dZQ==
X-Gm-Message-State: AN3rC/6lFJtsx9UlcKFA89HGZAA89WotcC6IotSt5aQLnfj9NnQ7RT+C 2Zmt3MZwMQ4j4kSafvs=
X-Received: by 10.157.2.196 with SMTP id 62mr1846880otl.71.1493267219459; Wed, 26 Apr 2017 21:26:59 -0700 (PDT)
Received: from ?IPv6:2602:ae:1b37:7300::2? ([2602:ae:1b37:7300::2]) by smtp.googlemail.com with ESMTPSA id f40sm734472otd.15.2017.04.26.21.26.57 for <ietf@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Apr 2017 21:26:57 -0700 (PDT)
Subject: Re: Why are mail servers not also key servers?
To: ietf@ietf.org
References: <849511c0-6526-ecbe-2b56-7b459eaf010b@hawaii.edu>
From: Doug Royer <douglasroyer@gmail.com>
Organization: http://SoftwareAndServices.NET
Message-ID: <07417f97-ada3-dc37-71ec-fcf68d67bee0@gmail.com>
Date: Wed, 26 Apr 2017 22:26:56 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.0
MIME-Version: 1.0
In-Reply-To: <849511c0-6526-ecbe-2b56-7b459eaf010b@hawaii.edu>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms080700000409080604080505"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/8XKuVGyWg_JMHz5rJEy4ro2eFdE>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Apr 2017 04:27:02 -0000

While discussing this topic in non-list email. I had other points that 
came up.

(1) The cert for a domain does not necessarily have the same CA as all 
other certs for users in a domain.

	Example:
		admin@example.com may have a CA assigned by
		the example.com, it could be self signed.

		doug@example.com may have a cert provided by an
		unrelated CA to admin@example.com

		Which can be a different cert from the site:
			https://virtual-host.com

		That happens to be hosted on example.com

Real life example, DouglasRoyer@gmail.com has a cert, the CA is 
StartCom. (This email is signed by that StartCom cert).
And it is not the same CA used by dns-admin@google.com

Both are at google.com, both have a different CA.

(2) Certificate chains.  Doug@eng.example.com may have a cert signed by 
the eng.example.com, and the eng.example.com cert may be signed by the 
example.com CA. The example.com CA, could be self signed, or be signed 
by an outside CA.



-- 

Doug Royer - (http://DougRoyer.US  http://goo.gl/yrxJTu )
DouglasRoyer@gmail.com
714-989-6135

v2.23.0 | Report a Bug | By Email