Subject: [Uta] I-D Action: draft-ietf-uta-email-deep-02.txt

From: [email-masked]
Date: Thu, 10 Mar 2016 22:13:47 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Using TLS in Applications of the IETF.

        Title           : Deployable Enhanced Email Privacy (DEEP)
        Authors         : Keith Moore
                          Chris Newman
	Filename        : draft-ietf-uta-email-deep-02.txt
	Pages           : 38
	Date            : 2016-03-10

Abstract:
   This specification defines a set of requirements and facilities
   designed to improve email confidentiality between a mail user agent
   (MUA) and a mail submission or mail access server.  This provides
   mechanisms intended to increase use of already deployed Transport
   Layer Security (TLS) technology, provide a model for mail user
   agent's confidentiality assurance, and enable mail service providers
   to advertise improved TLS confidentiality facilities.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-uta-email-deep/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-uta-email-deep-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-uta-email-deep-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Jeremy Harris <[email-masked]>
Date: Fri, 11 Mar 2016 17:40:24 +0000

> 	Filename        : draft-ietf-uta-email-deep-02.txt

4.3 para 2: "It is desirable to migrate MUA
   software to implicit TLS over time for consistency as well as the
   reasons discussed elsewhere in this document."

Where?  I think this needs an explicit reference; I certainly
didn't find where by a quick scan.  There was a note of
"STARTTLS on 587 has not replaced TLS-on-connect on 465"
(my paraphrase", but I don't see that as sufficient justification.

10.2 "Mail Service Providers that accept mail submissions from end-users
   using the Internet Protocol MUST provide one or more SMTP Submission
   servers for this purpose, separate from the SMTP servers used to
   process incoming mail."

This seems far too constraining; it could be interpreted as meaning
separate processes, separate binaries or even separate hardware.
How about "SMTP Submission services, separate from the SMTP MTA
services used to process incoming mail"  ?

-- 
Cheers,
  Jeremy

---

From: Chris Newman <[email-masked]>
Date: Fri, 11 Mar 2016 13:09:19 -0800

On March 11, 2016 at 1:40:36 , Jeremy Harris ([email-masked]) wrote:

> services used to process incoming mail” ?

Both good suggested changes; I’ve posted an update.

		- Chris

---

From: Aaron Zauner <[email-masked]>
Date: Mon, 14 Mar 2016 01:31:50 +0100

Hi,

Excellent to see that there's renewed progress with this (important) document!

I will be looking over the document again in the next few days a couple of times, I've just reviewed the diff and this came to mind:
Appendix A documents use of port 465 pretty well. It should be noted that there's a document that deprecates use of this port, but IETF/crypto-protocol-security discussion over the last years has showed clearly that in-band upgrade is not the way to go, hence STARTTLS and ports registered for it's use should continued to be used, but a paragraph might be added that use of port 465 (and thus implicit TLS as opposed to STARTTLS) is preferred. We don't get (stripable) in-band upgrade. It should also be noted that - in the current state of SMTP deployments at least - this port usually serves certificates that are not officially signed by certificate authorities, and are, quite often, broken in some sense: wrong/bad common name, strange extension fields and sometimes broken character-set induced problems in certificates.

Thanks for working on this again,
Aaron

---

From: Chris Newman <[email-masked]>
Date: Mon, 14 Mar 2016 14:30:18 -0700

On March 13, 2016 at 10:32:03 , Aaron Zauner ([email-masked]) wrote:
Hi, 

Thanks for working on this again, 
Aaron 
_______________________________________________ 
Uta mailing list 
[email-masked] 
https://www.ietf.org/mailman/listinfo/uta

---

From: Chris Newman <[email-masked]>
Date: Mon, 14 Mar 2016 14:34:34 -0700

Has the security area produced any published text describing the general benefits of implicit vs. STARTTLS? I can’t exactly reference a discussion on IETF/crypto-protocol-security.

There is existing text in the main document (as opposed to the non-normative appendix) that favors implicit TLS. If that’s not good enough, can you suggest wording improvements?

		Thanks,
		- Chris

Hi,

---

From: Aaron Zauner <[email-masked]>
Date: Thu, 17 Mar 2016 10:46:49 +0100

Hi Chris,

> On 14 Mar 2016, at 22:34, Chris Newman <[email-masked]> wrote:
> 

I'm not aware of any, unfortunately. I've only seen drafts and mailing list discussion in the past.

> There is existing text in the main document (as opposed to the non-normative appendix) that favors implicit TLS. If that’s not good enough, can you suggest wording improvements?

Yes, you are right. Reading over the document again I noticed it's explicitly mentioned already in the Introduction of the draft.

Aaron