RE: [lemonade] Re: Comments on draft-ietf-lemonade-urlauth-07.txt

<chair-hat>
We do not think that the edits suggested by Randy change the protocol
one whit, and thus can be addressed in AUTH48, without the need to
generate another draft.

Whine if one disagrees.
</chair-hat>

-----Original Message-----
From: lemonade-bounces@ietf.org [mailto:lemonade-bounces@ietf.org] On
Behalf Of Mark Crispin
Sent: Friday, August 05, 2005 6:07 AM
To: Randall Gellens
Cc: Lemonade; iesg@ietf.org
Subject: [lemonade] Re: Comments on draft-ietf-lemonade-urlauth-07.txt

It's 3AM here, so please forgive me if I have a brain fart.

On Fri, 5 Aug 2005, Randall Gellens wrote:
> Technical:
>
> Section 3, lines 239-241: "Use of either of these access
>    identifiers makes it impossible for an attacker, spying on the
>    session, to use the same URL, either directly or by submission to a
>    message submission entity."
>
> The "impossible" depends on the attacker being able to capture the
session, 
> but not be able to use the same submission server or to capture the
user's 
> authentication credentials (for either the IMAP or submit services).
While 
> this seems very obvious, and perhaps not worth saying, it does mean,
for 
> example, that an attacker who shares the same submission server can
reuse a 
> URLAUTH protected by "submit+",

I don't see how, given the semantics of submit+<userid>, which requires 
that "only a userid authorized as a message submission entity on behalf
of 
the specified userid is permitted to use this URL.  Normally, this will
be 
the current authorization userid on the submission server.

So the attacker must not merely share the same submision server; the 
attacker must be able to authorize as that userid on the submission 
server in order to reuse a URL protected by "submit+".

I don't think that I need to answer your other comments; the desired 
document action in each case all seems to be obvious.  Please let me
know 
if you feel that you need feedback, since otherwise I intend to do the 
seemingly obvious when preparing it for an RFC.

If I'm not mistaken, this document has finished WGLC and is awaiting
IESG 
action, correct?  If it's still in WGLC, I wouldn't mind issuing a new
I-D 
with your action items addressed.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
lemonade@ietf.org
https://www1.ietf.org/mailman/listinfo/lemonade

_______________________________________________
lemonade mailing list
lemonade@ietf.org
https://www1.ietf.org/mailman/listinfo/lemonade