Re: [imapext] SecDir review of draft-ietf-imapapnd-appendlimit-extension

S Moonesamy <sm+ietf@elandsys.com> Thu, 31 December 2015 21:48 UTC

Message-Id: <6.2.5.6.2.20151231134348.0d212f40@elandnews.com>
Date: Thu, 31 Dec 2015 13:47:42 -0800
To: Paul Wouters <paul@nohats.ca>
From: S Moonesamy <sm+ietf@elandsys.com>
In-Reply-To: <alpine.LFD.2.20.1512311626070.29547@bofh.nohats.ca>
References: <alpine.LFD.2.20.1512311626070.29547@bofh.nohats.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Archived-At: <http://mailarchive.ietf.org/arch/msg/imapext/t8FnZvY9HcS61TZKPnlCpHJ8LAI>
Cc: draft-ietf-imapapnd-appendlimit-extension.all@tools.ietf.org, imapext@ietf.org
Subject: Re: [imapext] SecDir review of draft-ietf-imapapnd-appendlimit-extension
Precedence: list

Hi Paul,
At 13:36 31-12-2015, Paul Wouters wrote:
>This document is Ready
>
>The document describes an IMAP extension to convey a limit size for
>appending to a mailbox. This prevents situations where the clients
>upload data only to have it rejected by the server. The security
>considerations are therefor limited in scope, as it is more of an
>optimization. The only item mentioned in the section is that an
>attacker that knows the limit could optimize their attack by sending
>better matching sized payloads for a denial-of-service attack, and
>servers should disconnect such clients as abusive. I believe that
>it correctly covers any new security risks that could arise from this
>document's specification. And that this issue is very minor compared
>to other DOS attacks possible by malicious clients that can successfully
>authenticate against the IMAP server.

Thanks for the review.

As a note for the authors, there isn't any issue.

Regards,
S. Moonesamy (as document shepherd)

Re: [imapext] SecDir review of draft-ietf-imapapn… S Moonesamy