Re: [secdir] [Uta] Secdir last call review of draft-ietf-uta-smtp-tlsrpt-17

"Brotman, Alexander" <> Wed, 14 March 2018 11:13 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6BE611241F3; Wed, 14 Mar 2018 04:13:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.01
X-Spam-Status: No, score=-0.01 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id L6AfBVVmFyNA; Wed, 14 Mar 2018 04:13:47 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5E679129C51; Wed, 14 Mar 2018 04:13:47 -0700 (PDT)
X-AuditID: 60721c4c-c0e6a7000000248e-d1-5aa903ea7379
Received: from ( []) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by (SMTP Gateway) with SMTP id 24.05.09358.AE309AA5; Wed, 14 Mar 2018 07:13:46 -0400 (EDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1365.1; Wed, 14 Mar 2018 07:13:45 -0400
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1365.1; Wed, 14 Mar 2018 05:13:44 -0600
Received: from ([fe80::3aea:a7ff:fe36:8380]) by ([fe80::3aea:a7ff:fe36:8380%19]) with mapi id 15.00.1365.000; Wed, 14 Mar 2018 05:13:44 -0600
From: "Brotman, Alexander" <>
To: Phillip Hallam-Baker <>
CC: "" <>, "" <>, "" <>, "" <>
Thread-Topic: [Uta] Secdir last call review of draft-ietf-uta-smtp-tlsrpt-17
Thread-Index: AQHTtxUkfu2V6vvAdU6QiQx2eVCljKPNNT0AgAGHJgCAAN5hIA==
Date: Wed, 14 Mar 2018 11:13:44 +0000
Message-ID: <>
References: <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_52346c59679e4623b1682784d7732a66COPDCEX19cablecomcastco_"
MIME-Version: 1.0
X-CFilter-Loop: Forward
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrJIsWRmVeSWpSXmKPExsWSUOxpofuKeWWUwe2l4haLptxnsbi6/DiT xbON81ksPix8yGJx6mgzowOrx85Zd9k9liz5yRTAFMVlk5Kak1mWWqRvl8CVMeHAU/aCbaUV +95OZGxgXFDUxcjJISFgIvHn/lOWLkYuDiGB7UwSs/sPMkE4BxklFlw/D+UcYpS4ObuNHcI5 ySix6cVsdpB+NgEribf/25lBbBEBbYmj+7awgtjMAgcYJQ7tsQCxhQW8JU6dOcYCUeMj0T57 AVS9k8S1R+vA6lkEVCXOLb3BBmLzCnhJLN/8FuqmM4wS00/9BUtwCgRK9Kx9xQhiMwqISXw/ tYYJYpm4xK0n85kgHhKQWLLnPDOELSrx8vE/VgjbQGLr0n0sELaixK95V9ggevMlOjrPsUIs FpQ4OfMJWI2QgJbE3hu7oHrFJQ4f2cE6gVFyFpJ1s5C0z0LSPouRAyiuKbF+lz5EiaLElO6H 7BC2hkTrnLnsyOILGNlXMfJYmukZGproGVnomZttYgRFeJGMzw7GT9M8DjEKcDAq8fBeZlgZ JcSaWFZcmQuMDQ5mJRHerTIrooR4UxIrq1KL8uOLSnNSiw8xSnOwKInzBj9aGCUkkJ5Ykpqd mlqQWgSTZeLglGpgvLYtKlT6lq3p1IJpz1aKyDWdq3av+M3B9PnD8dWavHlCWm8vFZ4+qeJ0 zfrtOp8fMoeWZi8+e/kk36nVZn8d1Zmi1T5lTP6zQiJElGvm2Yba+8bfhYPU9F2qmDcZHjt3 Y0/j2zmznWr3qKTe/SZp7xHLfo8x6bV4kFL9CzfBk/tqGB48Z05frcRSnJFoqMVcVJwIAO1v zG7sAgAA
Archived-At: <>
Subject: Re: [secdir] [Uta] Secdir last call review of draft-ietf-uta-smtp-tlsrpt-17
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 14 Mar 2018 11:13:49 -0000

Due to various obligations, I don’t believe any of the authors are going to be in London (I’ll double check).  I’m open to having a meeting/call to discuss this piece of the draft, whether it be during IETF in London or another time.

Alex Brotman
Sr. Engineer, Anti-Abuse

From: Uta [] On Behalf Of Phillip Hallam-Baker
Sent: Tuesday, March 13, 2018 11:50 AM
To: Brotman, Alexander <>;
Subject: Re: [Uta] Secdir last call review of draft-ietf-uta-smtp-tlsrpt-17

If folk are in London, lets talk to IANA and maybe some DNS folk.

I am pretty sure this is a straightforward issue. But it is one we need to get right.

On Mon, Mar 12, 2018 at 6:34 PM, Brotman, Alexander <<>> wrote:
I'm not opposed to change this to be in that form.  I don't believe this would cause any technical issues.

Alex Brotman
Sr. Engineer, Anti-Abuse

-----Original Message-----
From: Phillip Hallam-Baker [<>]
Sent: Thursday, March 08, 2018 2:39 PM
Subject: Secdir last call review of draft-ietf-uta-smtp-tlsrpt-17

Reviewer: Phillip Hallam-Baker
Review result: Has Issues

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

General comments:

Five minutes after I received the review request, a very similar proposal was made in CABForum for reporting PKIX cert issues.

The Security Considerations section proposes use of DNSSEC, what happens if that is misconfigured? Well it should be reported.

The logic of this proposal is that something like it become a standard deliverable for a certain class of service specification. I don't think we should delay this and meta-think it. But we should anticipate it being joined by others like it sharing syntax, DDoS mitigation, etc.

Specific issues

The DNS prefix _smtp-tlsrpt is defined. This is not mentioned in the IANA considerations. It is a code point being defined in a protocol that is outside the scope of UTA and therefore MUST have an IANA assignment and is a DNS code point which is shared space and therefore MUST have an assignment.

If no IANA registry exists, one should be created.

In general, the approach should be consistent with the following:

[RFC6763] S. Cheshire and M. Krochmal "DNS-Based Service Discovery" RFC 6763 DOI 10.17487/RFC6763 February 2013

It might well be appropriate to create a separate IANA prefix registry 'report'. That is probably easier since this prefix does not fit well with the existing ones.