There are too many technology about email security. So it is very difficult to understand what is really necessary, what is the goal.
In this slide, I explain about the summary of each technology to understand what you really need.
Qualitia CO., LTD HQ 3-11-10 Nihombashi-Kayabacho Chuo-ku Tokyo Capital 85M yen Since Oct. 1993 CEO Ken Matsuda ⚫ Development and Sales of Messaging Related Solutions ⚫ Supporting Efficient Communication and Security Enhancement ⚫ Providing the Messaging Related Cloud Services and Software Create the Future of “Communication” and “Security” with our Customers and Partners Q U A L I T Y M A K E S F U T U R E
HIRANO Yoshitaka Belongs to QUALITIA Co., Ltd Chief Engineer Cert. Licensed Scrum Master Certified Scrum Developer Activities M3AAWG JPAAWG IA Japan 迷惑Mail対策委員会 Anti-Spam mail Promotion Council (ASPC) Message Research Institute Audax Randonneurs Nihonbashi
Security SPF DKIM 誤送信 防止 Sanitize Password ZIP Anti Phishing Anti SPAM DNS SEC SMTP AUTH DANE MTA- STS START TLS BIMI ARC DMARC TLS- RPT Anti Virus Virus Filter Sandb ox Anshin Mark So many things!! I cannot understand
s=s1; h=From:Subject; b=abcdef・・・・ From: [email protected] Subject: Please transfer money to thief Hi! I'm Taro @ QUALITIA. ・・・・ When there is DKIM Tamper the signed message s1._domainkey.qualitia.co.jp txt “v=dkim1;p=ABCDEF...” Public Key Private Key クオリティア Spoofing・Tampering
is DKIM From: [email protected] Subject: Please transfer money AR: dkim=none Hi! I'm Taro @ QUALITIA. ・・・・ Ok, Transfer! Click! s1._domainkey.qualitia.co.jp txt “v=dkim1;p=ABCDEF...” Private Key Same as when there is not DKIM クオリティア Spoofing・Tampering Send without signature
From: [email protected] Subject: Please transfer money AR: dkim=none Hi! I'm Taro @ QUALITIA. ・・・・ Ehh? QUALITIA usually sign DKIM signature, right? s1._domainkey.qualitia.co.jp txt “v=dkim1;p=ABCDEF...” Private Key クオリティア Spoofing・Tampering Same as when there is not DKIM
DKIM •SPF: Even if the third party spoofed the Envelope From, still spf will be a “pass” •DKIM: Even if the third party signed,still dkim will be a “pass” Spoofing・Tampering
s=s1; h=From:Subject; b=abcdef・・・・ From: [email protected] Subject: [◦◦ML:1234] Hi! All AR: dkim=fail Hi! Long time no see! ・・・・ DKIM + Mailing List Hmm, can I trust? s1._domainkey.qualitia.co.jp txt “v=dkim1;p=ABCDEF...” decryption Public Key Private Key hash × クオリティア Spoofing・Tampering
Received Chain Protocol •RFC8617 (2019年7月) •Mailing List Server will write ARC signature with sequence number, if DKIM=pass, ARC=pass when it received. Spoofing・Tampering
•RFC8301: Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM) (Jan. 2018) ・Both signer and verifier MUST use rsa-sha256 ・Both MUST NOT use rsa-sha1 ・Sign: 1024bit～(MUST)、2048bit～(SHOULD) ・Verify: 1024bit～4096bit(MUST) ※ But 2048bit is longer than the size 255bytes which DNS can handle Spoofing・Tampering
•RFC8463: A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM) (Sep. 2018) ・Signer SHOULD implement this ・Verifier MUST implement this ・Write two signatures, Ed25519-SHA256 and RSA-SHA256(1024bit～) for backward compatibility Use Ed25519-SHA256 BASE64 encoded size is just 44 bytes, so this can be fit into DNS Spoofing・Tampering
•Follow the latest cryptography •Key rotation Too much hassle!!! We are creating a service to DKIM-sign automatically! Coming Soon! 注目 Spoofing・Tampering
If the multiple combinations of authentication, such as SMTP AUTH, device auth, biometric auth, are passed, you can send an email. Mail Server Device auth + Face auth OK Hijacking・Springboard
Mail Server Mail Server2 Eavesdropping Tampering If the server or client does not support STARTTLS, the client will send emails by plain text opportunistically. Mail Server1 Eavesdroppin
MTA-STS クオリティア Mail Server Mail Server Client does not send, if encryption is not supported _mta-sts.qualitia.co.jp. IN TXT "v=STSv1; id=20191114123000Z;" version: STSv1 mode: enforce mx: mx1.qualitia.co.jp max_age: 1296000 https://mta-sts.qualitia.co.jp/.well-known/mta-sts.txt ＝Not Stealed Eavesdroppin Policy
TLS-RPT クオリティア Mail Server Mail Server Send a report, if the encryption is not supported RFC8460 (Sep. 2018) _mta-sts.qualitia.co.jp. IN TXT "v=STSv1; id=20191114123000Z;" version: STSv1 mode: enforce mx: mx1.qualitia.co.jp max_age: 1296000 https://mta-sts.qualitia.co.jp/.well-known/mta-sts.txt _smtp._tls.qualitia.co.jp. IN TXT "v=TLSRPTv1;rua=mailto:[email protected]" Eavesdroppin
Mail Server Mail Server _mta-sts.qualitia.co.jp. IN TXT "v=STSv1; id=20191114123000Z;" version: STSv1 mode: enforce mx: mx1.qualitia.co.jp max_age: 1296000 https://mta-sts.qualitia.co.jp/.well-known/mta-sts.txt _smtp._tls.qualitia.co.jp. IN TXT "v=TLSRPTv1;rua=mailto:[email protected]" Server does not support TLS, so that client cannot send a report encryption Eavesdroppin
クオリティア Mail Server Mail Server _mta-sts.qualitia.co.jp. IN TXT "v=STSv1; id=20191114123000Z;" version: STSv1 mode: enforce mx: mx1.qualitia.co.jp max_age: 1296000 https://mta-sts.qualitia.co.jp/.well-known/mta-sts.txt _smtp._tls.qualitia.co.jp. IN TXT "v=TLSRPTv1;rua=https://api.qualitia.co.jp/v1/tlsrpt" HTTPS is also available https://api.qualitia.co.jp.jp/v1/tlsrpt POST Eavesdroppin
Mail Server Mail Server Mail Server ARP BGP ・・・ Certificate Authority (CA) 署名 qualitia.co.jp qualitia.co.jp Sign Compromised CA Everything seems fine for sender Trust Eavesdroppin
Server Mail Server Use DNS Trust chain instead of CA DNSSEC Certificate Authority(CA) No Need ルートDNS DNSSEC Trust Eavesdroppin _25._tcp.mx1.qualitia.co.jp. IN TLSA 3 0 1 2B73BB905F…" mx1.qualitia.co.jp
TLS-RPT, DANE •Operating DNSSEC is not easy •We cannot use DNSSEC easily (in Japan) •Do not want to Key-Rotate •Do not want to analyze the report Authoritative DNSSEC Service for Mail User We are now developing! 注目 Eavesdroppin
•Web Mail for BIMI •DKIM signing Service •SMTP Bio Auth Product, Service •Authoritative DNSSEC + Mail Setting Service •TLS Report Analysis Service •Virus Checking for Passworded Files Product •Attachment Separation for Mail Missending Prevention βユーザ募集！
hirachan
bbqallstars
nssv
kniino
tacck
abemii
lmi
koichiotomo
yuki_ink
oracle4engineer
salaboy
nikkei_engineer_recruiting
cassininazir
iamctodd
keathley
eileencodes
rocio
bkeepers
michaelherold
garrettdimon
tanoku
smashingmag
lauravandoore
