Subject: [Uta] MTA-STS vs. POSH

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 28 Aug 2018 12:43:51 -0600

The MTA-STS work seems very similar to PKIX over Secure HTTP (POSH) as
defined in RFC 7711:

https://www.rfc-editor.org/rfc/rfc7711.txt

Were the authors aware of POSH and, if so, what was the rationale for
defining a different approach?

Just curious. :-)

Peter

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 28 Aug 2018 16:25:47 -0400

> On Aug 28, 2018, at 2:43 PM, Peter Saint-Andre <[email-masked]> wrote:
> 

One important difference is that TLS in SMTP is opportunistic, so
much of the complexity is signalling *whether* to use authenticated
TLS, rather than how to do the authentication.

Secondarily, key fingerprints are fragile, name-based indirection
is more robust, at the cost of trusting the usual panoply of CAs.
Policies that pin names rather than fingerprints are much more
stable, especially because the customer publishes the same MX
hosts in their DNS, so it is data they control.

-- 
-- 
	Viktor.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 28 Aug 2018 15:23:15 -0600

> TLS, rather than how to do the authentication.

Agreed.

> hosts in their DNS, so it is data they control.

Thanks for the clarification, Viktor!

Peter

---

From: Daniel Margolis <[email-masked]>
Date: Tue, 28 Aug 2018 20:13:03 -0700

For reference, some previous discussion here, too:
https://www.ietf.org/mail-archive/web/ietf/current/msg107374.html.

On Tue, Aug 28, 2018 at 2:23 PM Peter Saint-Andre <[email-masked]>
wrote:

> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>