Re: [secdir] SECDIR Review of draft-ietf-qresync-rfc5162bis-10

[Jeffrey Hutzelman <[e-mail]>]

On Thu, 2014-02-13 at 19:31 -0500, Phillip Hallam-Baker wrote:


> We have a problem here, the security considerations in the draft are
> a back reference to the original protocol. This is the security references
> section of IMAP, a core Internet protocol in their entirety:
> 
> 11 <http://tools.ietf.org/html/rfc3501#section-11>.     Security Considerations
> 
>    IMAP4rev1 protocol transactions, including electronic mail data, are
>    sent in the clear over the network unless protection from snooping is
>    negotiated.  This can be accomplished either by the use of STARTTLS,
>    negotiated privacy protection in the AUTHENTICATE command, or some
>    other protection mechanism.

Nope.  That's the entirety of the _introduction_ to the security
considerations section in RFC33501.  It is followed by two subsections
which give a fairly detailed treatment of issues related to
authentication, connection security, and handling of passwords.

That's not to say the security considerations in the IMAP spec are
complete and perfect; they're certainly not.  For example, there is no
discussion of authorization and access control.  However, incomplete is
not the same as nonexistent, and there is no need here to be alarmist.

-- Jeff