Re: [secdir] SECDIR Review of draft-ietf-qresync-rfc5162bis-10

Phillip Hallam-Baker <hallam@gmail.com> Fri, 14 February 2014 02:20 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D15BD1A004C for <secdir@ietfa.amsl.com>; Thu, 13 Feb 2014 18:20:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rOIGTg1t5ZSL for <secdir@ietfa.amsl.com>; Thu, 13 Feb 2014 18:20:20 -0800 (PST)
Received: from mail-lb0-x22b.google.com (mail-lb0-x22b.google.com [IPv6:2a00:1450:4010:c04::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 73A411A0016 for <secdir@ietf.org>; Thu, 13 Feb 2014 18:20:20 -0800 (PST)
Received: by mail-lb0-f171.google.com with SMTP id c11so8827601lbj.16 for <secdir@ietf.org>; Thu, 13 Feb 2014 18:20:18 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=tmM2ao+lZHlEfoM/A93fbyAaN+Ctwg3bKTFMZuUml+c=; b=dhJctR7oK7/mmsKQrWlaDbPq/sIx8LAWcT2iYec2hEHzFfOYOluW+DIW+lwCH/ISYD HZO+IMwUX7oKuQM9yaDrdsR9C7bhXbfbKH70s34yBsCoV3s6ZErUJCjOtkS0AFqHpCjB VdTGHmIVEm2CfQViJXBGG8PCgKtiUnKIfRwkq5QSpSTjswGkBE4zEeBfkwpG5mctfS3d 9k8Zv/UvtpA2fSKYIcyiITPlE6zeP1Hr7xhpGzsVNxtVBJG4Ewv6Dgtlb4/tmcYu/0eO jOF4N+fU0n8QsA5JOotLRdtPtvW/QEZICLA+ZzOOdKIiSeSN5YJWvds9t8ljQaNGPM79 v5WA==
MIME-Version: 1.0
X-Received: by 10.152.28.7 with SMTP id x7mr17369lag.57.1392344418377; Thu, 13 Feb 2014 18:20:18 -0800 (PST)
Received: by 10.112.37.168 with HTTP; Thu, 13 Feb 2014 18:20:18 -0800 (PST)
In-Reply-To: <1392341826.4569.14.camel@destiny.pc.cs.cmu.edu>
References: <CAMm+LwhWJ2Csb0V3ymvULscfRuxDkuF11FRBbFv4Bt_2LqZFbQ@mail.gmail.com> <1392341826.4569.14.camel@destiny.pc.cs.cmu.edu>
Date: Thu, 13 Feb 2014 21:20:18 -0500
Message-ID: <CAMm+LwjdmJ_c3dVApnuCzsB6VfY_qut2NN-Y=2OWPdLve=TN-w@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: Jeffrey Hutzelman <jhutz@cmu.edu>
Content-Type: multipart/alternative; boundary=089e0160bf7076650404f2547265
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/HYyr0myLj_V3Vl8LoE7a-iqNJ20
Cc: "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] SECDIR Review of draft-ietf-qresync-rfc5162bis-10
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 14 Feb 2014 02:20:27 -0000

On Thu, Feb 13, 2014 at 8:37 PM, Jeffrey Hutzelman <jhutz@cmu.edu> wrote:

> On Thu, 2014-02-13 at 19:31 -0500, Phillip Hallam-Baker wrote:
>
>
> > We have a problem here, the security considerations in the draft are
> > a back reference to the original protocol. This is the security
> references
> > section of IMAP, a core Internet protocol in their entirety:
> >
> > 11 <http://tools.ietf.org/html/rfc3501#section-11>.     Security
> Considerations
> >
> >    IMAP4rev1 protocol transactions, including electronic mail data, are
> >    sent in the clear over the network unless protection from snooping is
> >    negotiated.  This can be accomplished either by the use of STARTTLS,
> >    negotiated privacy protection in the AUTHENTICATE command, or some
> >    other protection mechanism.
>
> Nope.  That's the entirety of the _introduction_ to the security
> considerations section in RFC33501.  It is followed by two subsections
> which give a fairly detailed treatment of issues related to
> authentication, connection security, and handling of passwords.
>
> That's not to say the security considerations in the IMAP spec are
> complete and perfect; they're certainly not.  For example, there is no
> discussion of authorization and access control.  However, incomplete is
> not the same as nonexistent, and there is no need here to be alarmist.
>

Weird and I was looking for it..

There is a problem in that it does not state what the attack model is. It
seems as if the attack model is limited to a passive attack.

If there is an active MITM attack, SSL will only provide protection if the
server certificate is authenticated. Otherwise, passing the username and
password enclair is problematic.



-- 
Website: http://hallambaker.com/