Subject: [Uta] TLS report sensitivity

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 16 Nov 2017 18:29:39 -0500

Just listening to the recording of the meeting about sensitivity of
reports.  One thing to keep in mind is that reports will often need
to be sent to the very domain which is failing STS validation, so
in fact one may well need to deliver the reports at *reduced*
security, relative to normal mail traffic, so that the reports get
through!

Therefore, the considerations as such should not mandate strong
transport protection, but rather should only promote avoiding
putting anything in the report that would not already be observed
by a passive wiretap.

-- 
	Viktor.

---

From: Jim Fenton <[email-masked]>
Date: Fri, 17 Nov 2017 00:50:37 -0800

> putting anything in the report that would not already be observed
We weren't talking about mandating anything, just saying something in
the spec to cause people to think about it. It might be the case that
some report recipients don't want to use SMTP for their reports at all.

---

From: Daniel Margolis <[email-masked]>
Date: Fri, 17 Nov 2017 09:43:42 +0000

Yeah, I think this is why we support HTTPS delivery. :)

It's all a generally fair point. One comment I had made in the Jabber was
that in general a MITM who can observe a lot of traffic over the reporting
period (e.g. 24h) can probably infer passively most of the details of the
report itself. So the very attack that allows one to read a report sent
over plaintext or unauthenticated SMTP, extended for a mere day, allows one
to generate one's own report.

So there's some sensitivity, and HTTPS is a useful fallback also in case
SMTP delivery itself simply doesn't work, but I am not too hung up on this.

On Fri, Nov 17, 2017 at 9:50 AM Jim Fenton <[email-masked]> wrote:

> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 17 Nov 2017 04:48:43 -0500

> On Nov 17, 2017, at 3:50 AM, Jim Fenton <[email-masked]> wrote:
> 

Sure some recipients may prefer HTTPS, but keep in mind that the
sender does not get much choice, the "rua" is chosen by the
receiving system.  So the sender may have to send at least some
reports via email.  Furthermore, email has the advantage that
sending systems already support queueing and retries, while with
HTTPS, one would have to build some new system to increase the
odds of "eventual" delivery of the report.  Many domains (for
better or worse) will have the same wildcard certificate for
HTTPS and SMTP, and will have a non-working report HTTPS URI
at the same time that their MTAs starts having problems.

So email (with REQUIRETLS=NO) has advantages over HTTPS for
report delivery.

-- 
	Viktor.