Re: [secdir] SECDIR Review of draft-ietf-qresync-rfc5162bis-10

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Feb 13, 2014 at 8:37 PM, Jeffrey Hutzelman <[e-mail]> wrote:

> On Thu, 2014-02-13 at 19:31 -0500, Phillip Hallam-Baker wrote:
>
>
> > We have a problem here, the security considerations in the draft are
> > a back reference to the original protocol. This is the security
> references
> > section of IMAP, a core Internet protocol in their entirety:
> >
> > 11 <http://tools.ietf.org/html/rfc3501#section-11>.     Security
> Considerations
> >
> >    IMAP4rev1 protocol transactions, including electronic mail data, are
> >    sent in the clear over the network unless protection from snooping is
> >    negotiated.  This can be accomplished either by the use of STARTTLS,
> >    negotiated privacy protection in the AUTHENTICATE command, or some
> >    other protection mechanism.
>
> Nope.  That's the entirety of the _introduction_ to the security
> considerations section in RFC33501.  It is followed by two subsections
> which give a fairly detailed treatment of issues related to
> authentication, connection security, and handling of passwords.
>
> That's not to say the security considerations in the IMAP spec are
> complete and perfect; they're certainly not.  For example, there is no
> discussion of authorization and access control.  However, incomplete is
> not the same as nonexistent, and there is no need here to be alarmist.
>

Weird and I was looking for it..

There is a problem in that it does not state what the attack model is. It
seems as if the attack model is limited to a passive attack.

If there is an active MITM attack, SSL will only provide protection if the
server certificate is authenticated. Otherwise, passing the username and
password enclair is problematic.



-- 
Website: http://hallambaker.com/