Subject: [dane] NIST SP 1800-6 out for public comment

From: "Rose, Scott" <[email-masked]>
Date: Wed, 2 Nov 2016 13:44:38 -0400

(sorry if you get multiple copies)

The National Cybersecurity Center of Excellence (NCCoE) and NIST have a 
new Special Publication: 1800-6 on DNS-Based Secure Email out for public 
comment.  This project was to develop guidance and recommendations for 
enterprises in deploying DANE to support SMTP over TLS and S/MIME using 
SMIMEA RRs.  The three part guide is on the NCCoE website: 
https://nccoe.nist.gov/projects/building_blocks/secured_email

In short - the project was to demonstrate using DANE to support SMTP and 
S/MIME using different certificate usage values (used 1-3, skipped 0 
since it was viewed as least likely to be recommended).  The cert usage 
values were chosen to give examples that would meet various local 
security polices.

Comments welcome.  The deadline for comments is Dec 15, 2016 but will 
likely still be open to suggestions and comments (informally) beyond 
that date.

Thanks,
Scott

==================================
Scott Rose, NIST
[email-masked]
ph: +1-301-975-8439
Google Voice: +1-571-249-3671

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 02 Nov 2016 18:57:59 +0100

> https://nccoe.nist.gov/projects/building_blocks/secured_email

Ah, it is available now.

I planned to give a quick introduction to it in the dnssec-workshop at ICANN-57

	jaa[

---

From: "Paul Hoffman" <[email-masked]>
Date: Wed, 02 Nov 2016 11:20:23 -0700

On 2 Nov 2016, at 10:44, Rose, Scott wrote:

> The National Cybersecurity Center of Excellence (NCCoE) and NIST have 
> a new Special Publication: 1800-6 on DNS-Based Secure Email out for 
> public comment.  This project was to develop guidance and 
> recommendations for enterprises in deploying DANE to support SMTP over 
> TLS and S/MIME using SMIMEA RRs.  The three part guide is on the NCCoE 
> website: https://nccoe.nist.gov/projects/building_blocks/secured_email
>
> In short - the project was to demonstrate using DANE to support SMTP 
> and S/MIME using different certificate usage values (used 1-3, skipped 
> 0 since it was viewed as least likely to be recommended).  The cert 
> usage values were chosen to give examples that would meet various 
> local security polices.
>

Maybe this will cause a few more people to want to comment on the WG 
Last Call on SMIMEA...

--Paul Hoffman

---

From: Sean Turner <[email-masked]>
Date: Wed, 2 Nov 2016 22:24:43 -0400

Not really DANE specific, but I gotta ask:  Did I miss the reference to RFC 7525?

spt

> On Nov 02, 2016, at 13:44, Rose, Scott <[email-masked]> wrote:
> 
> The National Cybersecurity Center of Excellence (NCCoE) and NIST have a new Special Publication: 1800-6 on DNS-Based Secure Email out for public comment.  This project was to develop guidance and recommendations for enterprises in deploying DANE to support SMTP over TLS and S/MIME using SMIMEA RRs.  The three part guide is on the NCCoE website: https://nccoe.nist.gov/projects/building_blocks/secured_email
> 
> In short - the project was to demonstrate using DANE to support SMTP and S/MIME using different certificate usage values (used 1-3, skipped 0 since it was viewed as least likely to be recommended).  The cert usage values were chosen to give examples that would meet various local security polices.
> 
> Comments welcome.  The deadline for comments is Dec 15, 2016 but will likely still be open to suggestions and comments (informally) beyond that date.
> 
> Thanks,
> Scott
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: "Rose, Scott" <[email-masked]>
Date: Thu, 3 Nov 2016 09:35:33 -0400

No, you didn’t.  It wasn’t included.  I’ll read it and make sure 
to incorporate it in the revision round.

Thanks,
Scott

On 2 Nov 2016, at 22:24, Sean Turner wrote:

>> recommendations for enterprises in deploying DANE to support SMTP 
>> over TLS and S/MIME using SMIMEA RRs.  The three part guide is on the 
>> NCCoE website: 
>> and S/MIME using different certificate usage values (used 1-3, 
>> skipped 0 since it was viewed as least likely to be recommended).  
>> The cert usage values were chosen to give examples that would meet 
>> various local security polices.
>>