Re: [saag] IETF 93 Agenda Request - Key Discovery

[Richard Barnes <[e-mail]>]

On Thu, Jul 23, 2015 at 5:31 PM, John Levine <[e-mail]> wrote:
>>> I don't know why you think MXs or MTAs have any role in this at all.
>>> The major point of this stuff is to look up keys for e2e, ...
>
> Because MTAs are the only ones that know what account goes with what
> addresses.  (Remember that when you log in for SUBMIT, your credentials
> as often as not are not your address.)
>
> As I said yesterday in a related thread, here's my usage model:
>
> I set up my online access at Bigbank.  One of the things I do is to
> give them the addresss [e-mail].  The bank looks up my
> PGP key and sends all subsequent mail encrypted to my key, which in
> this case happens to be the same one as for [e-mail].

Thanks a lot for the example.  I was wondering what Viktor meant by
"canonicalization".  I understand better now why you guys are inclined
to localize things on the MTA, however...


> My MTA already knows where it routes that address and can find the
> appropriate account and the corresponding keys.  Webfinger or anything
> else would either need a side channel into the MTA or try to match the
> local address resolution logic.  Ugh.

Consider the security requirements.  The MUA needs to know that it's
got the authentic address/key binding, where the address is the one
the user put into the MUA.  So if it's going to talk to an MTA, it
needs to be the REMOTE MTA.  If it reaches that remote MTA through its
local MTA, that's a problem, since now either (1) the MUA has to trust
the local MTA for all of its keys or (2) the remote MTA needs to sign
its address/key bindings.  Both of which are gross.

For security reasons, then, you're going to need to depart from your
usual mail protocol habits.  So you might as well just ditch the old
protocol and do something that's easier for implementors to build to.
Yes, you might have to wire your WebFinger (etc) server to your MTA --
but only if you have non-trivial translation rules.

--Richard


>
> R's,
> John
>
> PS: To summarize some lengthy discussions in DANE, the response to
> any suggestion starting "You can just canonicalize the address by ..."
> is "No, that may work on your MTA, but it doesn't work in general."
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag