[DNSOP] Re: [art] Re: DNS-designated Public Key Author ities (DKA)

It appears that Ben Schwartz  <[email protected]> said:
>My preference would be to eliminate this TXT record from the design
>entirely.  Instead, DKA discovery could proceed via HTTP .well-known
>on the email domain, in-band via new SMTP commands (with TLS
>authentication), or in many other ways that do not allow an attacker
>to intercept and replace users' keys with their own.

While I generally agree with you, life is complicated.

At a lot of organizations the people who run the mail and the people who run the
website do not talk to each other. So if you want to publish key info for
[email protected], and want to put it at
https://example.com/.well-known/pubkey.txt or maybe
https://example.com/.well-known/pubkey/bob.smith, you would often be told to
forget it.

RFC 8461 publishes info about mail TLS preferences called MTA-STS, and it fudges
the issue by hijacking the label mta-sts, e.g. the policy is at
https://mta-sts.example.com/.well-known/mta-sts.txt. You might be able to do
that.

While an SMTP extension is a technical possibility, in practice, again forget it.  SMTP has
a VRFY command that you have probably never heard of which is intended to let you check if
a mail address exists.  Spammers discovered it about 30 years ago to harvest mail addresses,
and everyone turned it off.  A key server extension would be similarly unpopular.

So I guess the mta-sts like hack is a possibility, but I would think hard about how you
are going to make it usable without also making it an attractive nuisance.

R's,
John

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]