Re: [secdir] SECDIR Review of draft-ietf-qresync-rfc5162bis-10

[Phillip Hallam-Baker <[e-mail]>]

Hit send prematurely


On Thu, Feb 13, 2014 at 7:31 PM, Phillip Hallam-Baker <[e-mail]>wrote:

>
>   I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
> We have a problem here, the security considerations in the draft are
> a back reference to the original protocol. This is the security references
> section of IMAP, a core Internet protocol in their entirety:
>
> 11 <http://tools.ietf.org/html/rfc3501#section-11>.     Security Considerations
>
>    IMAP4rev1 protocol transactions, including electronic mail data, are
>    sent in the clear over the network unless protection from snooping is
>    negotiated.  This can be accomplished either by the use of STARTTLS,
>    negotiated privacy protection in the AUTHENTICATE command, or some
>    other protection mechanism.
>
>
>
Such an important protocol needs a full security review. Commenting on how
an extension might affect the protocol seems rather pointless/ineffective
when the original protocol has not been reviewed and raises serious security
concerns.

-- 
Website: http://hallambaker.com/