Subject: [Uta] MTA-STS-03 review

From: ranjana mukhia <[email-masked]>
Date: Tue, 4 Apr 2017 17:42:59 +0530

Hi All,

I have a basic question to ask related to the below-mentioned lines of the
draft.

>We additionally consider the Denial of Service risk posed by an

>  attacker who can modify the DNS records for a victim domain.  Absent
>   SMTP STS, such an attacker can cause a sending MTA to cache invalid
>   MX records for a long TTL.  With SMTP STS, the attacker can

>   additionally advertise a new, long-"max_age" SMTP STS policy with
>  "mx" constraints that validate the malicious MX record, causing
>   senders to cache the policy and refuse to deliver messages once the
>   victim has resecured the MX records.

>   This attack is mitigated in part by the ability of a victim domain to
>   (at any time) publish a new policy updating the cached, malicious
>   policy, though this does require the victim domain to both obtain a
>   valid CA-signed certificate and to understand and properly configure
>   SMTP STS.

*can the above mentioned solution, provide the preemptive measure for
avoiding the DOS attack?*

Regards

Ranjana

Centre for Development  of Advanced Computing(CDAC),Bangalore(India)

---

From: Daniel Margolis <[email-masked]>
Date: Tue, 4 Apr 2017 16:20:59 +0200

Hi,

Can you explain a little more what you mean? The mitigation is to publish a
new policy with the correct values, so certainly anyone who does so
pre-emptively is not likely to fall victim to a DoS attack. More
specifically, anyone who is _aware_ of this risk should simply ensure
untrusted individuals cannot publish content with a certificate for *.
example.com on "mta-sts.example.com"; the risk is for domains like (say)
tumblr.com who may inadvertently allow that.

On Tue, Apr 4, 2017 at 2:12 PM, ranjana mukhia <[email-masked]> wrote:

> *can the above mentioned solution, provide the preemptive measure for avoiding the DOS attack?*
>
>
>
> Regards
>
> Ranjana
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 4 Apr 2017 18:21:23 +0000

> tumblr.com who may inadvertently allow that.

I too found the text in question confusing.  It makes no mention
the attacker is presumed able to obtain certificates for
"mta-sts.example.com", but otherwise the description does not make
much sense.  The DNS TXT record does indeed facilitate recovery
after the fact by signalling the availability of an updated policy.

I would also like to encourage the authors to post revised drafts
more frequently.  Please see:

    https://www.ietf.org/mail-archive/web/ietf/current/threads.html#101804

-- 
	Viktor.

---

From: [email-masked]
Date: Tue, 04 Apr 2017 12:32:58 -0700 (PDT)

>     https://www.ietf.org/mail-archive/web/ietf/current/threads.html#101804

+1000.

				Ned

---

From: Daniel Margolis <[email-masked]>
Date: Tue, 18 Apr 2017 17:05:20 +0200

Thanks for the feedback. I think we were not sure how careful we should be
about posting frequently vs spamming people with intermediate drafts. ;)

What text do you find confusing? You mean this?

Similarly, we consider the possibility of domains that deliberately
>    allow untrusted users to serve untrusted content on user-specified
>    subdomains.  In some cases (e.g. the service Tumblr.com) this takes
>    the form of providing HTTPS hosting of user-registered subdomains; in
>    other cases (e.g. dynamic DNS providers) this takes the form of
>    allowing untrusted users to register custom DNS records at the
>    provider's domain.
>

>    In these cases, there is a risk that untrusted users would be able to
>    serve custom content at the "mta-sts" host, including serving an
>    illegitimate MTA-STS policy.