Re: [saag] IETF 93 Agenda Request - Key Discovery

[Viktor Dukhovni <[e-mail]>]

On Thu, Jul 23, 2015 at 04:38:14PM +0200, Richard Barnes wrote:

> I don't know why you think MXs or MTAs have any role in this at all.
> The major point of this stuff is to look up keys for e2e, so it's most
> likely to be implemented in MUAs, most of which either already have an
> HTTP stack (to support HTML email), or are web pages themselves.  If
> you want to add this to a web mail client, here's your implementation:

Because, MTAs implement all the optional case-folding, address
extensions, address canonicalization, ... logic that makes an email
address ultimately reach some user's mailbox.  They also provide
front-line abuse defense.

> function getKey(uri) {
>   var xhr = new XMLHttpRequest();
>   xhr.open("GET", makeWebfingerURL(uri), false);
>   xhr.send();
>   var jrd = JSON.parse(xhr.responseText);
>   return jrd.properties.keys;
> }

Of course, the request should be via HTTPS, and to really scale to
cover more domains, should support DANE auth, but all the client
API convenience in the world won't help if the request reaches a
server that can't provide the right answer, because the knowledge
of which email addresses are valid, what their canonical forms are,
etc., is in the MTA.

Also in the MTA are any keys for gateway-layer decryption of initial
contact email.  Many (corporate) gateways will choose to not expose
per-user keys to the outside, and will publish only the MTA's keys
to the outside world (regulatory compliance and corporate security
requirements).

> > WebFinger requires email server operators to also deploy HTTP
> > WebFinger servers, or email servers to support an additional request
> > protocol.  Neither seems necessary.
> 
> That is only necessary if you want to make keys discoverable for your
> users.  And it's probably easier than upgrading your MTA to support
> some new thing.

Deploying a later release of the MTA software is not notably onerous.

New data sources don't magically implement themselves without
software changes on the server side, even when new requests are
carried over an existing general-purpose protocol.  Even WebFinger
servers would need new server-side software to respond to to the
newly proposed request messages.

The domain owner would typically implement the address to keys
mapping as part of provisioning email addresses at the MTA, just
another lookup table that leverages existing logic to
normalize/canonicalize email addresses at which poitn the relevant
keys can be located.

-- 
	Viktor.