Subject: Re: E-Mail Protocol Security Measurements

From: Aaron Zauner <[email-masked]>
Date: Fri, 30 Oct 2015 12:00:30 +0100

Hi,

Starting up this thread again; our paper has been published today
open-access and our data-sets are currently in the process of being
published on scans.io.

The paper is available at http://arxiv.org/abs/1510.08646

In terms of scanning methodology there's nothing entirely new here
but we've collected TLS enumeration scans for all publicly available
e-mail servers (POP, IMAP, SMTP) on the Internet.

Aaron

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 31 Oct 2015 05:06:30 +0000

> e-mail servers (POP, IMAP, SMTP) on the Internet.

Thanks for the paper, it contains a substantial quantity of useful
information.

I am however rather disappointed by how some of the results are
interpreted, at least by non-experts:

    http://arstechnica.com/security/2015/10/dont-count-on-starttls-to-automatically-encrypt-your-sensitive-e-mails/

    Offsetting that progress was a finding that about 770,000 SMTP
    servers associated with the Alexa top million list still failed
    to properly secure their systems. Only 82 percent of them
    supported TLS, and of those, only 35 percent were properly
    configured to allow one server to cryptographically authenticate
    itself to another.

What's missing here is that having trusted SSL certificates offers
zero protection for MTA-to-MTA SMTP.  Any time/money spend on such
certificates is essentially wasted.  Barring DANE or similar
out-of-band policy, certificates *cannot* protect MTA-to-MTA SMTP
from MITM attacks.

I cringe every time someone bemoans the lack of "valid" certificates
in SMTP, such certificates are largely a worthless fashion statement.
(Some domains have bilateral arrangements with business partners
to verify email traffic certificates, but these arrangements are
exceedingly rare).

STARTTLS is designed to thwart exactly one attack: *passive* wiretap.
It works as designed for just that attack.  It is not surprising
that active attacks can and do defeat STARTTLS,

Hence, DANE for SMTP and related efforts.  No mass-scale use of
end-to-end encryption is looming to save the day, so transport
security is finally getting the attention it deserves.  My DANE
survey is at 9000 domains and counting, with adoption picking up
the pace a bit lately.  Some domain hosting providers have implemented
tens of thousands of additional DANE domains that do not show up
in my surveys.  It is still very early in the process, but I am
cautiously optimistic.

-- 
	Viktor.

---

From: Aaron Zauner <[email-masked]>
Date: Sat, 31 Oct 2015 06:28:16 +0100

Hi Viktor,

>     configured to allow one server to cryptographically authenticate

That article is referencing another paper, presented at IMC15 by
UMichigan, UCI and Google researchers, publicly available over here:
http://conferences2.sigcomm.org/imc/2015/papers/p27.pdf

..there're also problems with some of the details in the article.

(Yeah, we haven't yet got any media exposure :))

> to verify email traffic certificates, but these arrangements are

Yes. But even for mail there're valid points to use official
certificates (i.e. nodes clients talk to). For MTA to MTA
communication various solutions have been suggested, to the best of
my knowledge none is widely deployed so far.

> that active attacks can and do defeat STARTTLS,

What their paper does highlight is how vendor appliances actively
*break* STARTTLS while performing their duties (i.e. some feature a
customer might have actually payed for). It's an essential problem
on the internet that middleboxes break legit internet-traffic. I've
seen it in ISP-, educational and corporate environments. They also
highlight that this technique is being used on a large scale by some
states to essentially wiretap e-mail communication.

> in my surveys.  It is still very early in the process, but I am

Is data on your DANE survey publicly available anywhere or are there
more details on that? I'd be very interested in the results.

Thanks,
Aaron

---

From: John C Klensin <[email-masked]>
Date: Sat, 31 Oct 2015 10:20:50 -0400

--On Saturday, October 31, 2015 5:06 AM +0000 Viktor Dukhovni
<[email-masked]> wrote:

>> Starting up this thread again; our paper has been published
>> today open-access and our data-sets are currently in the
>> process of being published on scans.io.
>...

> What's missing here is that having trusted SSL certificates
> offers zero protection for MTA-to-MTA SMTP.  Any time/money
> spend on such certificates is essentially wasted.  Barring
> DANE or similar out-of-band policy, certificates *cannot*
> protect MTA-to-MTA SMTP from MITM attacks.

Viktor,

I appreciate your enthusiasm, but I'd like to suggest, again,
that, as people move from measurement and statistical analysis
(as in the parts of the paper by Aaron and his colleagues I
read) and into claims of protection and vulnerability we all be
very careful about extreme claims.

First, unless I'm missing a key part of your reasoning, if one
really had a "trusted SSL certificate" and used it properly,
"zero protection" seems like a dubious claim.   I'd consider a
"trusted SSL certificate" to suggest an X.509 certificate with a
CA issuer whom one could verify and whose practices really
include verification of the applicant and the applicant's
ability to properly manage private keys.  You may reasonably
claim that those criteria are almost never satisfied today and
that almost all TLS connections between SMTP sender and SMTP
receiver are made in the same casual way that almost all HTTPS
ones are.  You may reasonably also claim that TLS with
self-signed certs (at least with no external knowledge or
prearrangement) fall somewhere on the scale between "useless"
and "only a fool would trust one, but there are a lot of fools
out there".  I'd probably agree with both, but those are
problems with what users (who rarely have a clue about any of
this) and SMTP senders are willing to accept, not with the
certificate model itself.

Very similar comments apply to DANE-based certificates.  Domains
are hijacked every day.  Even where DNSSEC is deployed, many
users and even SMTP senders depend on DNS forwarding systems
that can be (and sometimes are) attacked and compromised and do
not have end to end DNSSEC verification.  Whether the typical
registrar or registrar-agent is more or less scrupulous about
selling domain names and documenting and verifying purchasers
than the typical CA is about selling certificates (many of them,
today, based entirely on the ability to receive email at an
associated domain) is an open question but we all come out the
losers.  

>...
> STARTTLS is designed to thwart exactly one attack: *passive*
> wiretap. It works as designed for just that attack.  It is not
> surprising that active attacks can and do defeat STARTTLS,

Right.  But that takes us back to active attacks to compromise
mail servers, queues, and/or mail stores, attacks that can be
(and historically almost certainly were) easier and more common
than activate attacks against transit links.   If one is a state
actor trying to obtain message content, making such attacks by
administrative action is easier yet and requires no technical
skill at all.   Also, if I were an attacker and could
successfully attack the SMTP receiver host, I might be able to
compromise the private (decryption) key, after which the link
encryption provides no useful protection either.

> survey is at 9000 domains and counting, with adoption picking
> up the pace a bit lately.  Some domain hosting providers have
> implemented tens of thousands of additional DANE domains that
> do not show up in my surveys.  It is still very early in the
> process, but I am cautiously optimistic.

I am not, for the record, opposed to hop-by-hop transit
encryption and agree that good end to end approaches do not seem
to be on the horizon.  But I think it is very important to be
careful about the claims that are made for what is protected and
how good that protection is.  It seems to me that some of your
enthusiasm for DANR is not keeping to a high standard for being
careful about claims of protection.

    best,
    john

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 31 Oct 2015 15:09:22 +0000

On Sat, Oct 31, 2015 at 10:20:50AM -0400, John C Klensin wrote:

> "zero protection" seems like a dubious claim. 

I meant what I said and I said what I meant:

    https://tools.ietf.org/html/rfc7672#section-1.3
    https://tools.ietf.org/html/rfc7672#section-1.3.1
    https://tools.ietf.org/html/rfc7672#section-1.3.2
    https://tools.ietf.org/html/rfc7672#section-1.3.3
    https://tools.ietf.org/html/rfc7672#section-1.3.4

    https://tools.ietf.org/html/rfc7435

[ Certificate wrong, yet the message still sent. ]

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 31 Oct 2015 16:57:54 +0000

> (Yeah, we haven't yet got any media exposure :))

Thanks for the clarification, the coincidence in the timing led me
astray into linking the article with the wrong paper.

> certificates (i.e. nodes clients talk to).

Yes, WebPKI are well suited for submission, POP and IMAP.

> For MTA to MTA

Yes, none are even lightly deployed.  At some tens of thousands of
domains, DANE deployment is still rather negligible, I am hoping
that will start to change in 2016.

> more details on that? I'd be very interested in the results.

I am not doing research, so the results are not intended for
publication.  Rather I am monitoring deployment, and clearing
hurdles to deployment by notifying operators of nameservers that
handle DNSSEC poorly and operators of domains who publish incorrect
or stale TLSA records.

In ~September last year I was able to identify only ~200 DANE
domains and around 4000 domains whose DNS breaks DANE.  Now it is
9000+ DANE domains, and under 100 domains whose DNS breaks DANE.

Of the 9000 domains, 6200 are hosted by 3 registrars, most of the
rest are domains operated by individual "hobbyists".  However 27
domains (up from 24 two weeks ago) are "large enough" to appear to
Google's email transparency report.

At least 40% of the domains are registered in Germany.

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 31 Oct 2015 19:07:39 +0000

On Sat, Oct 31, 2015 at 07:15:51AM -0400, Watson Ladd wrote:

> Before STARTTLS adoption the Tunisian secret police read all your
> emails. Afterwards they still do. What was gained? Let's try solving
> that problem.

Funny you should say that, that's a good part of what I've been
doing for the past 2.5 years.  However, simply having more SMTP
servers feeling good about useless WebPKI certs is not the answer.

Additional, downgrade-resistant out-of-band signalling is required
as explained in RFC7435 and RFC7672.  I've been working on one such
signalling model that is gaining some initial traction.

-- 
	Viktor.