[lemonade] Re: Comments on draft-ietf-lemonade-urlauth-07.txt

At 3:07 AM -0700 8/5/05, Mark Crispin wrote:

>  It's 3AM here, so please forgive me if I have a brain fart.
>
>  On Fri, 5 Aug 2005, Randall Gellens wrote:
>>  Technical:
>>
>>  Section 3, lines 239-241: "Use of either of these access
>>     identifiers makes it impossible for an attacker, spying on the
>>     session, to use the same URL, either directly or by submission to a
>>     message submission entity."
>>
>>  The "impossible" depends on the attacker being able to capture the 
>> session, but not be able to use the same submission server or to 
>> capture the user's authentication credentials (for either the IMAP 
>> or submit services).  While this seems very obvious, and perhaps 
>> not worth saying, it does mean, for example, that an attacker who 
>> shares the same submission server can reuse a URLAUTH protected by 
>> "submit+",
>
>  I don't see how, given the semantics of submit+<userid>, which 
> requires that "only a userid authorized as a message submission 
> entity on behalf of the specified userid is permitted to use this 
> URL.  Normally, this will be the current authorization userid on 
> the submission server.
>
>  So the attacker must not merely share the same submision server; 
> the attacker must be able to authorize as that userid on the 
> submission server in order to reuse a URL protected by "submit+".

This comment was a minor one, since I don't think it affects the 
security considerations either way.

Likely I'm the one confused, but if user B captures a urlauth URL for 
user A, and shares the same servers, then B can submit a new message 
using the same urlauth URL, right?  If they don't share the same 
servers (both submission and IMAP), then this won't work.

Also, if B can capture the message submission of A, then B can 
directly capture data not referenced by a URL, and this is a threat 
regardless of the use of urlauth or not.

>
>  I don't think that I need to answer your other comments; the 
> desired document action in each case all seems to be obvious.

I agree, the bulk of my comments were requests for minor wording 
tweaks or typo corrections.

>    Please let me know if you feel that you need feedback, since 
> otherwise I intend to do the seemingly obvious when preparing it 
> for an RFC.

No need to respond to each of my comments individually.

>  If I'm not mistaken, this document has finished WGLC and is 
> awaiting IESG action, correct?  If it's still in WGLC, I wouldn't 
> mind issuing a new I-D with your action items addressed.

My understanding is it has passed WGLC.  I anticipated that my 
comments would get addressed with IETF Last Call or IESG comments, if 
any; if there are none then AUTH48 will do.

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
There's only one corner of the universe you can be certain of
improving that's your own self.               --Aldous Huxley

_______________________________________________
lemonade mailing list
lemonade@ietf.org
https://www1.ietf.org/mailman/listinfo/lemonade