Subject: Re: [dane] DANE+SMTP draft

From: [email-masked] (Martin Rex)
Date: Fri, 1 Jun 2012 18:20:51 +0200 (CEST)

Yaron Sheffer wrote:
> 
> - In addition, this sentence conflicts with the earlier text "If these 
> security requirements are not satisfied, this protocol does not take 
> effect.  The client SHOULD fall back to insecure delivery (which might 
> be over unauthenticated TLS)." So we do allow fallback to 
> "unauthenticated TLS" (and implicitly also to plaintext?), which is in 
> fact vulnerable to the same MITM attacker.

I agree that this suggestion (SHOULD fall back to insecure delivery)
looks non-sensical.  If insecure deliver *is* acceptable, then
confidentiality protected insecure delivery must be even more so,
therefore aborting the connection is a bad idea.

-Martin

---

From: Tony Finch <[email-masked]>
Date: Fri, 1 Jun 2012 17:24:16 +0100

> therefore aborting the connection is a bad idea.

I already replied to Yaron saying:

No, the fallback occurs when the DNSSEC part of the protocol has not been
(completely) deployed. A MITM cannot spoof DNSSEC responses, so it can't
force a downgrade on the MX or TLSA lookups.

The latest draft says:

   For this protocol to take effect, all of these DNS RRsets MUST be
   "secure" according to DNSSSEC validation.  In the case of an implicit
   MX record, there MUST be a secure denial of existence of an MX RRset
   for the mail domain.  In the case of a (chain of) CNAME RRs, all the
   CNAMEs MUST be secure as well as their ultimate target.

   If they are not all secure, this protocol has not been fully
   deployed.  The client SHOULD fall back to insecure delivery (which
   might be over unauthenticated TLS).

Does that make it clearer?

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
North FitzRoy, Sole: Easterly veering southerly or southwesterly 4 or 5,
increasing 6 at times. Moderate, occasionally rough in west. Rain or thundery
showers, fog patches at first in east Sole. Moderate or good, occasionally
very poor at first in east Sole.