[Cryptography] Strong DNS Names

[Phill]

A while ago, I proposed a new form of ‘strong email address’ that combined a PGP fingerprint like identifier with an email address:

MB2GK-6DUF5-YGYYL-JNY5E?alice at example.com <mailto:alice at example.com>

The idea of this scheme is that MB2GK-6DUF5-YGYYL-JNY5E is the fingerprint of a key under which a policy for sending mail to alice at example.com <mailto:alice at example.com> is signed. That might have statements like ‘emails must be signed’, ‘use PGP’, etc.

Note that as with Tor, merely having the address does not mean that you can use it. But that is what we want.


The Tor scheme is better in some ways.

alice at example.com.MB2GK-6DUF5-YGYYL-JNY5E.onion <mailto:alice at example.com.mb2gk-6duf5-ygyyl-jny5e.onion>

But the .onion means Tor and I don’t want to have .openpgp, .smime etc. It would not work. 

I have a better idea:

alice at example.com.MB2GK-6DUF5-YGYYL-JNY5E


There is no need for a suffix at all. The probability of an accidental collision here is 2^92 and we can use a variety of techniques (e.g. work hardening) to increase the work factor. We can even pile on more characters if need be.

No need for permission from ICANN either. Their US government mandate expires in a few months and I don’t recognize their new one.

From a deployment perspective, we can (and should) allow clients to retrieve policies from their trusted DNS server by simply adding a line to the effect that if the TLD is more than 24 characters long, interpret it as a UDF key fingerprint.

The new strong DNS addresses are compatible with pretty much every existing email client. Just route the inbound and outbound email through a proxy that strips off fingerprints from strong email addresses, fetches the policy and acts accordingly. Users can compose and read email just like normal. The only difference being that their email is now encrypted end to end (but not in client storage).

Yes, a proper client that does this native is better but only if the product is done really-right rather than botched and bungled user experience that Microsoft, Apple and Thunderbird offer. I greatly appreciate the heroic efforts of people writing plug ins but having written some myself I don’t think that is a viable model to produce world class user experience. The base applications are just too buggy.


The chief security issue here is that if we are talking about alice at eop.gov <mailto:alice at eop.gov> or alice at microsoft.com <mailto:alice at microsoft.com> or the like, we want to make sure that we are talking to the implied domain if it matters. Which is something that enterprises can do with an appropriate CAA record requiring messages to that domain be supported by a suitably validated cert.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20160907/40201038/attachment.html>