What is SMTP Strict Transport Security or SMTP STS?

by | Mar 9, 2017 | Data Breaches and Prevention, Email Security, Privacy

destination mail server to make the attack transparent.

Interested readers can find more information on how DNS hijacking attacks are perpetrated while transporting emails: How can attackers steal sensitive data of emails using the DNS hijacking attack?

What is DANE?

DANE, or DNS-based Authentication of Named Entities, is a protocol that is developed recently. It can address the above security concerns of SMTP, though it has some other concerns.

In this protocol, the source mail server makes a DNS query to obtain TLSA records from the DNS servers before sending the email. TLSA records are new DNS resource records that contain information on the digital certificate and the Certificate Authority (CA). This information helps in the subsequent TLS connection between the source and destination mail servers.

So, the source mail server first obtains the TLSA records from the DNS servers and then validates the records using DNSSEC. In DNSSEC, responses from DNS servers are validated with digital signatures and cryptographic keys. As it is not possible for attackers to duplicate cryptographic keys and affect DNSSEC responses, DANE can address the above security concerns of SMTP up to a great extent.

Interested readers can find more information on how DNSSEC works here: What is DNSSEC, and how does it work?

What is SMTP Strict Transport Security or SMTP STS?

Though DANE can address the major security concerns of SMTP up to a great extent, it may not be very convenient to use. DANE requires DNSSEC for secure delivery. But, the implementation of DNSSEC is quite complex, and its adoption is quite slow. To address those concerns a new protocol called SMTP STS is developed.

SMTP STS or SMTP Strict Transport Security is a policy that ensures secure SMTP sessions over TLS. It presents a variant for systems that do not yet support DNSSEC. It also specifies a method for reporting TLS negotiation failures while establishing a TLS connection between the mail servers.

The main difference between DANE and SMTP STS is that DANE requires DNSSEC to authenticate DANE TLSA records. However, SMTP STS relies on the Certificate Authority system to avoid interceptions.

How does SMTP Strict Transport Security or SMTP STS work?

When an email is sent from the source mail server to the destination mail server, it typically follows the following steps :

  • The source mail server makes a DNS query and obtains the TXT record and MX record of the destination mail server. The TXT record contains information on the SMTP STS policy of the destination mail server. And, the MX record presents its TLS certificate.
  • The next step for the source mail server honoring the SMTP STS policy is to fetch and validate the policy.
  • If the TXT record specifies DNSSEC, the source mail server should retrieve the policy via DNSSEC.
  • If the TXT record specifies Web PKI, the source mail server should establish an HTTPS connection to a specified host with the domain matching that of the destination mail server. The HTTP response body thus obtained must match the policy initially loaded by the DNS TXT method.
  • The next step is policy validation. For Web PKI, the certificate presented by the MX record must be valid for the MX name and chain to a root CA that is trusted by the source mail server.
  • Otherwise, DANE TLSA is used to validate the certificate.
  • Aggregate statistics on the policy failure may be reported to a specified URI for diagnosis.

How does SMTP Strict Transport Security or SMTP STS improve security?

As discussed above, SMTP STS relies on the proper validation of the policy and the certificate. As the …

Facebooktwitterredditpinterestlinkedinmail

Calculate the pseudoinverse of a matrix using Python

What is the pseudoinverse of a matrix? We know that if A is a square matrix with full rank, then A-1 is said to be the inverse of A if the following condition holds: $latex AA^{-1}=A^{-1}A=I $ The pseudoinverse or the Moore-Penrose inverse of a matrix is a...

Cholesky decomposition using Python

What is Cholesky decomposition? A square matrix A is said to have Cholesky decomposition if it can be written as a product of a lower triangular matrix and its conjugate transpose. $latex A=LL^{*} $ If all the entries of A are real numbers, then the conjugate...

Tensor Hadamard Product using Python

In one of our previous articles, we already discussed what the Hadamard product in linear algebra is. We discussed that if A and B are two matrices of size mxn, then the Hadamard product of A and B is another mxn matrix C such that: $latex H_{i,j}=A_{i,j} \times...

Perform tensor addition and subtraction using Python

We can use numpy nd-array to create a tensor in Python. We can use the following Python code to perform tensor addition and subtraction. import numpy A = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) B = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) C =...

How to create a tensor using Python?

What is a tensor? A tensor is a generalization of vectors and matrices. It is easily understood as a multidimensional array. For example, in machine learning, we can organize data in an m-way array and refer it as a data tensor. Data related to images, sounds, movies,...

How to combine NumPy arrays using horizontal stack?

We can use the hstack() function from the numpy module to combine two or more NumPy arrays horizontally. For example, we can use the following Python code to combine three NumPy arrays horizontally. import numpy A = numpy.array([[1, 2, 3], [4, 5, 6], [7, 8, 9]]) B =...

How to combine NumPy arrays using vertical stack?

Let’s say we have two or more NumPy arrays. We can combine these NumPy arrays vertically using the vstack() function from the numpy module. For example, we can use the following Python code to combine three NumPy arrays vertically. import numpy A = numpy.array([[1, 2,...

Singular Value Decomposition (SVD) using Python

What is Singular Value Decomposition (SVD)? Let A be an mxn rectangular matrix. Using Singular Value Decomposition (SVD), we can decompose the matrix A in the following way: $latex A_{m \times n}=U_{m \times m}S_{m \times n}V_{n \times n}^T $ Here, U is an mxm matrix....

Eigen decomposition of a square matrix using Python

Let A be a square matrix. Let’s say A has k eigenvalues λ1, λ2, ... λk. And the corresponding eigenvectors are X1, X2, ... Xk. $latex X_1=\begin{bmatrix} x_{11} \\ x_{21} \\ x_{31} \\ ... \\ x_{k1} \end{bmatrix} \\ X_2=\begin{bmatrix} x_{12} \\ x_{22} \\ x_{32} \\ ......

How to calculate eigenvalues and eigenvectors using Python?

In our previous article, we discussed what eigen values and eigenvectors of a square matrix are and how we can calculate the eigenvalues and eigenvectors of a square matrix mathematically. We discussed that if A is a square matrix, then $latex (A- \lambda I) \vec{u}=0...

Amrita Mitra

Author

Ms. Amrita Mitra is an author, who has authored the books “Cryptography And Public Key Infrastructure“, “Web Application Vulnerabilities And Prevention“, “A Guide To Cyber Security” and “Phishing: Detection, Analysis And Prevention“. She is also the founder of Asigosec Technologies, the company that owns The Security Buddy.

0 Comments

Submit a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Not a premium member yet?

Please follow the link below to buy The Security Buddy Premium Membership.

Featured Posts

Translate »