Subject: [Uta] MTA-STS & max-age

From: "A. Schulze" <[email-masked]>
Date: Thu, 15 Aug 2019 23:03:19 +0200

Hello,

reading RFC 8461 again and again I find not answer on "is there is a minimum value?"

https://tools.ietf.org/html/rfc8461#section-3.2 say

      "max_age": Max lifetime of the policy (plaintext non-negative
      integer seconds, maximum value of 31557600).  Well-behaved clients
      SHOULD cache a policy for up to this value from the last policy
      fetch time. To mitigate the risks of attacks at policy refresh
      time, it is expected that this value typically be in the range of
      weeks or greater.

The RFC define a maximum but only an expectation for the minimum :-/

There are not as many implementations in use. What does implementers think on this?
How do you handle max_age > 31557600 and do you require any minimum value for max_age?

postfix-mta-sts-resolver for example require only a value >= 0 .
https://github.com/Snawoot/postfix-mta-sts-resolver/blob/c7b3d179fb10277f9bcdc77e7cd91627c879a48b/postfix_mta_sts_resolver/resolver.py#L144

Andreas

---

From: Daniel Margolis <[email-masked]>
Date: Mon, 26 Aug 2019 18:00:07 +0200

I think it's reasonable for someone just deploying a policy to set a
max_age that's very small--like, a day or less. (They of course should also
use report-only mode to try to ensure things work during launch, but this
would be an additional safety measure.)

A max_age above the max results in a non-compliant policy. I guess senders
should probably treat that like any other syntactically invalid policy (and
not honor it). Trying to guess what the implementor meant seems like a bad
idea in the long run.

I'm not sure if that's useful feedback or not.

On Thu, Aug 15, 2019 at 11:04 PM A. Schulze <[email-masked]> wrote:

> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

-- 
How's my emailing? http://go/dan-email-slo

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 26 Aug 2019 14:59:47 -0400

> would be an additional safety measure.)

At the low end, the sending MTA may be burdened with overly frequent
HTTPS policy checks.  Implementations might therefore set a floor
on the max_age, and not check more frequently.  Any such floor
should be as small as practical, hours not days.

> not honor it). Trying to guess what the implementor meant seems like a bad

The only other available option is to truncate larger values to an
acceptable maximum.  Implementations are always free to use shorter
values than the max_age in the policy, even when the policy value
is below the RFC limit.

-- 
	Viktor.