Subject: [Asrg] RE: 3b. SMTP Session Verification - STARTTLS

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 4 Mar 2004 06:38:53 -0800

> The SMTP clients and servers exchange that information during 
> the EHLO 
> session of the SMTP transaction. Why do you need to advertise 
> that via DNS?

There is a downgrade attack. The parties do not know
that the other accepts TLS. This means that an active man
in the middle attack could be used to prevent the session
upgrading to TLS

Of course if you do not have DNSSEC the same argument 
could be made against DNS

> Leaving all of this aside, how will the use of TLS with SMTP help 
> resolve the spam problem?

It is just another authentication mechanism, very similar to
CallerID/SPF in features offered. But it does have a much higher
barrier to entry - for the authentication to be useful you need
trustworthy third parties.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Mark Baugher <[email-masked]>
Date: Thu, 04 Mar 2004 09:30:15 -0800

Phill,

>in the middle attack could be used to prevent the session

I don't think we should worry about active man-in-the-middle attacks 
against antispam mechanisms.  It seems like a lot of work to get a 
relatively small effect.  Besides that, even if TLS were generally used 
between MTAs, it would not be universal.  I think at best, TLS would 
introduce a new class of mail, i.e. mail from authenticated smtp 
senders.  So the m-i-m attack would serve only to downgrade particular mail 
and never succeed in upgrading it.

Mark

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 04 Mar 2004 12:52:56 -0500

> trustworthy third parties.

You can probably make a DK-like variation by storing the TLS key in DNS 
avoiding third parties. Of course that would depend on what you are 
trying to authenticate - if its just a domain then it would be 
sufficient, but if you need an address for legal process, you need a 
third party or some other mechanism.

BUT, in any case, authentication is a means to an end. From everything 
that has been discussed about authentication so far, it leads to 
authorization of some kind which has been proposed so far either via 
reputation/accreditation or "web of trust".

If the entire purpose of authentication is to lead to authorization, 
what kind of systems would we use? How would we avoid problems that 
plague existing blacklists? Would allowing CAs into doing a reputation 
service in addition to authentication wise? How will all of this reduce 
spam?

Yakov