Re: Devilish: Forget about DNS

Mark Foster wrote:
> On Mon, Feb 09, 2004 at 02:20:51PM -0500, Yakov Shafranovich wrote:
> 
>>What bothers me is that there are two separate identities at stake here:
>>1. Identity of the incoming MTA.
>>2. Sender's identity
> 
> Many of the MTAs in use today support the STARTTLS mechanism. In order
> to accomplish this, the MTA must be configured with a X.509 certificate
> that is either self-signed, or signed (issued) by a certficate authority.
>  
> Also, some of those MTAs can be configured to use the same (or different)
> certificate outgoing (as a client), and to recognize certificate authorities
> for trust verification.
>  
> But AFAIK none of the MTAs I have looked at currently support CRL or OSCP.
>  

The question is who issues the certificates. If the certificate is self 
signed than its useless unless you can somehow tie it in to something 
(domain, IP, etc.).

> In talking about secure Internet email, everyone seems focused on S/MIME certs
> for end-users. Why not also advocate the use of certificate verification (PKI)
> in message relaying MTA-to-MTA?  This just seems like a natural direction for
> the  email infrastructure.
> 

This is exactly what I am wondering - we need to verify two separate 
things - the MTA and the sender, and the methods to do so will vary.

Yakov

P.S. Mark, your list delivery has been disabled, contact me off-list.
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Among all our enemies / The ones to be most feared are often the 
smallest" (Jean de la Fontaine)
-------