Re: Devilish: Forget about DNS

On Mon, Feb 09, 2004 at 02:20:51PM -0500, Yakov Shafranovich wrote:
> What bothers me is that there are two separate identities at stake here:
> 1. Identity of the incoming MTA.
> 2. Sender's identity

Many of the MTAs in use today support the STARTTLS mechanism. In order
to accomplish this, the MTA must be configured with a X.509 certificate
that is either self-signed, or signed (issued) by a certficate authority.
 
Also, some of those MTAs can be configured to use the same (or different)
certificate outgoing (as a client), and to recognize certificate authorities
for trust verification.
 
But AFAIK none of the MTAs I have looked at currently support CRL or OSCP.
 
In talking about secure Internet email, everyone seems focused on S/MIME certs
for end-users. Why not also advocate the use of certificate verification (PKI)
in message relaying MTA-to-MTA?  This just seems like a natural direction for
the  email infrastructure.

-- 
Some days it's just not worth chewing through the restraints...
Mark Foster <[email protected]>  http://mark.foster.cc/