Subject: Re: [v6ops] Draft on email transition to IPv6 from IPv4 for sevice providers and other communities

From: "Joe St Sauver" <[email-masked]>
Date: Fri, 22 Jul 2011 10:54:22 -0700 (PDT)

Keith commented:

#One of the things that I've been wondering is whether IPv6 provides a good
#excuse/lever to have all email that crosses administrative domain boundaries
#over IPv6, use TLS and AUTH EXTERNAL and authenticate to SMTP servers using
#client certificates.   Ideally it would use DNSSEC to authenticate the client
#certs instead of relying on trusted CAs.  But I think all of the protocol work
#should be defined, it just needs to be profiled.   This seems like it might be 
#an opportunity to raise the level of email security in general and also raise
#the bar for spammers. 

Just a couple of quick points:

-- I'm a huge fan of opportunistic TLS wherever it can be deployed, including 
   for SMTP (whether that SMTP server uses IPv4 or IPv6 transport or both).

-- Because (as of July 2011) I've taken on additional duties as the 
   certificate program manager for the Internet2/InCommon Certificate Service
   (http://www.incommon.org/cert/) in addition to my continuing 
   responsibilities as Internet2's security program manager under contract 
   through UO, to avoid any potential perception of a COI when it comes to
   promoting use of certificates, I'll simply say that:

   -- I'd agree that there are *many* potential security-enhancing ways that 
      one can potentially employ server and personal certificates, and

   -- My support for both traditional well-trusted CAs *and* for the IETF 
      DANE work leveraging DNSSEC for key trust management is a matter of 
      record (for example, I co-presented with Leif from SUNET/NORDUNet
      as part of the DANE session at the April 2011 Internet2 Memeber
      Meeting in Arlington). I don't view one model as precluding the other,
      and ideally speaking, I'd like to see sites embrace both.

Regards,

Joe

---

From: Keith Moore <[email-masked]>
Date: Fri, 22 Jul 2011 15:24:26 -0400

>   for SMTP (whether that SMTP server uses IPv4 or IPv6 transport or both).

I'm actually proposing something slightly more ambitious than opportunistic TLS here.  I'm proposing that the normal profile for relaying IPv6 mail over SMTP be defined to use STARTTLS, AUTH EXTERNAL, and client certificates authenticated via DNSSEC.   (or maybe, via either DNSSEC or a trusted CA...that would make it a tad easier.)

Keith

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 22 Jul 2011 12:34:21 -0700

> I'm actually proposing something slightly more ambitious than opportunistic TLS here.  I'm proposing that the normal profile for relaying IPv6 mail over SMTP be defined to use STARTTLS, AUTH EXTERN…

This is your solution to you claim that ipv6 blocklist management won't scale?

> Keith
> 
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Keith Moore <[email-masked]>
Date: Fri, 22 Jul 2011 15:53:40 -0400

> This is your solution to you claim that ipv6 blocklist management won't scale?

There's more than one kind of scaling.   The problem with basing reputation on IPv6 source addresses is that IPv6 source addresses are even less meaningful than IPv4 addresses in this regard, and IPv4 addresses are already of pretty marginal value.   The consequence of basing reputation on a meaningless value is that more innocent peoples' mail gets blacklisted.  Whether you think of this as a scaling problem depends on your POV.

Keith