Subject: [saag] Request for discussion of Mandatory Secure Mail Delivery proposal (draft-wchuang-msmd)

From: Wei Chuang <[email-masked]>
Date: Tue, 15 Oct 2013 12:35:26 -0700

Hi apps-discuss and saag,

Request for discussion (draft-wchuang-msmd) of a proposal to secure mail from
eavesdropping and MitM attacks.  I posted the primary thread to
ietf-smtp@and request that all discussion go to that list
.

Here's the abstract:

   Opportunistic SMTP TLS does not enforce electronic mail delivery
   using TLS leading to potential loss of privacy and security.  We
   propose an optional mail header extension "mandatory-secure-mail-
   delivery:" and SMTP EHLO response extension "MSMD" that indicates
   mail must be delivered privately using TLS and with integrity using
   DKIM, and thereby provide a security guarantee to the user.  When
   mail is sent with the header indicating privacy and integrity and if
   the receiving party does not support this, the mail is instead
   bounced.  To protect the mail after delivery, the destination SMTP
   server must advertise its capabilities as part of the EHLO response,
   and the sender can choose whether the destination is able to honor
   the privacy requirements specified on the mail header.

Link to the proposal here:
http://datatracker.ietf.org/doc/draft-wchuang-msmd/

-Wei

PS Pardon for any IETF formatting or etiquette errors as I'm very new to
the IETF process.

---

From: Bill Mills <[email-masked]>
Date: Thu, 17 Oct 2013 11:32:55 -0700

1) If the sender wants to enforce this they can simply refuse to send unless STARTTLS is available?

2) How o you ensure that all hops to the destination are covered by TLS?

-bill

--------------------------------
William J. Mills
"Paranoid" Yahoo!

On Tuesday, October 15, 2013 12:35 PM, Wei Chuang <[email-masked]> wrote:

Request for discussion (draft-wchuang-msmd) of a proposal to secure mail from eavesdropping and MitM attacks.  I posted the primary thread to ietf-smtp@ and request that all discussion go to that list.

Here's the abstract:
Opportunistic SMTP TLS does not enforce electronic mail delivery using TLS leading to potential loss of privacy and security.  We propose an optional mail header extension "mandatory-secure-mail- delivery:" and SMTP EHLO response extension "MSMD" that indicates mail must be delivered privately using TLS and with integrity using DKIM, and thereby provide a security guarantee to the user.  When mail is sent with the header indicating privacy and integrity and if the receiving party does not support this, the mail is instead bounced.  To protect the mail after delivery, the destination SMTP server must advertise its capabilities as part of the EHLO response, and the sender can choose whether the destination is able to honor the privacy requirements specified on the mail header.

-Wei

PS Pardon for any IETF formatting or etiquette errors as I'm very new to the IETF process.

_______________________________________________
apps-discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/apps-discuss