Re: I-D ACTION:draft-ietf-sasl-crammd5-to-historic-00.txt

[Paul Smith <[e-mail]>]

John C Klensin wrote:
> I would certainly agree with that conclusion about clear-text
> over TLS if it were substantiated.  However, in a world in which
> typical certs for mail servers seem to be either self-signed (or
> certified on the basis of email address dialogues or domain name
> ownership), in which attacks on the DNS are well-known and the
> proper response to "Bind 8 is dead" may be "before or after Bind
> 4?", methods based on challenge-response may have one advantage
> that the I-D does not discuss, namely being independent of the
> certificate and DNS situation and relationships.  
>   
I think this is an important issue. So, I agree with John's 'plan of
attack' here.

CRAM-MD5 makes it a lot harder for MITM attacks than plain text over an
unverified TLS link does. While plain text over TLS does stop attacks
from 'eavesdroppers' it does nothing for MITM attacks in most cases.

I think one thing that some people seem to forget is that most people
who use email have no clue what TLS is, or how certificates work. For
plain text over TLS to be more secure (IMV) than CRAM-MD5, average users
would have to check mail server certificates, which they won't do.

- I can see the point in the draft about an a priori agreement about
character set, but is that really a big deal? 'sequence of ASCII
printable characters encoded in an octet with zero parity, with no
normalization' pretty much covers every case of passwords I've ever seen
anyone use - even in non-latin character set countries.

- No, CRAM-MD5 doesn't protect the user ID from eavesdroppers, but plain
text over TLS protects neither the user ID nor the password from a MITM
attack if the certificate isn't verified. CRAM-MD5 does protect the
password from both eavesdroppers and MITM attacks. Given that a large
number of mail providers use easily guessable user IDs (for ease of use
by users), I'm not sure how significant this 'weakness' in CRAM-MD5 is
*in real life*.

Now, in *some cases* I can see that plain text/TLS is better than
CRAM-MD5 - where the mail system is managed by competent techies, and
where email software is installed for users by those techies (so
certificates can be configured properly), but in the vast majority of
cases out there, I think the choice would be CRAM-MD5, plain text over
an unencrypted session, or plain text over a dubiously encrypted session
- which is better?

CRAM-MD5 has a large deployed server base out there. I don't think PLAIN
over TLS is a secure alternative, and SCRAM is still 'work in progress'
(and I remember the issues that we STILL have because we deployed SMTP
'AUTH' support before that was finalised ('AUTH=CRAM-MD5' vs 'AUTH
CRAM-MD5' anyone?)).

-- 
Paul Smith

VPOP3 - POP3/SMTP/IMAP4/Webmail Email server for Windows