[Last-Call] Re: draft-ietf-emailcore-as-28 ietf last call Secdir r eview

[S Moonesamy <[e-mail]>]

Hi Shivan,
At 10:51 PM 27-04-2026, Shivan Sahib via Datatracker wrote:
>My remaining issue is still with Section 6.5 (Confidentiality Requirements),
>which was extensively rewritten and discussed.
>
>Section 6.5 establishes three normative requirements:
>
>1. Confidentiality (e.g., STARTTLS) MUST be implemented by SMTP servers.
>2. Confidentiality MUST be used when sending if it is available and 
>accepted by
>the receiving server. 3. SMTP-receivers MUST be configurable to allow for
>receiving messages without specific confidentiality mechanisms, or 
>even without
>confidentiality.
>
>I support requirements (1) and (2) but not (3).
>
>Using MUST for the cleartext-reception configurability requirement seems
>unnecessarily strong. Why are we *mandating* implementers to support 
>cleartext?
>I understand that there are many providers who don't or can't support TLS, but
>then this should be a MAY or similar. I don't think the current state or
>statistics of deployments changes anything here; IETF shouldn't mandate
>implementers to not have confidentiality for compat reasons. Mandating
>plaintext for compat reasons in an RFC seems like a security anti-pattern. I
>also noted the concern about "possible future regulatory requirements... could
>result in bans on confidentiality mechanisms in some countries". This again
>seems unconvincing as rationale to require cleartext.
>
>I know this topic has been discussed to death, and the WG generally feels like
>we're quibbling over not-much, but with my SECDIR hat on I have to call this
>out as having issues (or one issue in particular).

I'll comment on (3).  I don't have any problem with you calling out 
the one issue.  There was one or more comments about not having (3) 
might break email.  A community could move forward without (3) if it 
is okay with taking responsibility for breaking email in some part(s) 
of the world.

I did a little reading and I came a few countries where there were 
regulatory controls on cryptography.  I don't know whether those 
regulatory controls are enforced or not.  I don't have a strong view 
on the matter as I am not in one of the few countries.

Regards,
S. Moonesamy