Re: [secdir] secdir review of draft-elie-nntp-tls-recommendations-01

[Julien ÉLIE <[e-mail]>]

Hi David,

> On 2016-12-08 16:47, Julien ÉLIE wrote:
>> I believe it is OK to take the following text into account for the
>> ports to use for NNTP over TLS, but I prefer to share with you the
>> wording in case you have any comments about it.  (Maybe it is not
>> clear enough!)
>> We would then have in Appendix A of the document:
>>
>>  The third and fourth paragraphs in Section 1 of [RFC4642] are
>>  replaced with the following text:
>>
>>   TCP port 563 is dedicated to NNTP over TLS, and registered in the
>>   IANA Service Name and Transport Protocol Port Number Registry for
>>   that usage.  NNTP implementations using TCP port 563 begin the TLS
>>   negotiation immediately upon connection and then continue with the
>>   initial steps of an NNTP session.  This use of strict TLS on a
>>   separate port is the preferred way of using TLS with NNTP.
>>
>>   If a host wishes to offer separate servers for transit and reading
>>   clients, TCP port 563 SHOULD be used for the reading server using
>>   strict TLS.  If a transit server offers strict TLS, it SHOULD use TCP
>>   port 433 if it does not accept unencrypted connections, but can
>>   alternatively use another unused port of its choice.  If it accepts
>>   dynamic upgrade from unencrypted to TLS-protected traffic, it SHOULD
>>   use TCP port 433 for that usage, and another unused port of its
>>   choice for strict TLS.  In either case, the port used for strict TLS
>>   should be clearly communicated to the client, and specifically that
>>   no plain-text communication occurs before the TLS session is
>>   negotiated.
>
> From a security point of view, I have no objection to this text.

... unless if it can lead to "protocol switching attack between TLS and 
NNTP" as you hint at below:


> I'm a bit surprised that you're using the same port (433) for both plain
> TLS and for STARTTLS, but as long as clients and servers are configured
> correctly, that should work. I assume there's no protocol switching
> attack between TLS and NNTP?

Well, you're right there's something weird here.
In fact, I was suggesting to use port 433 for strict TLS when the 
transit server only allows encrypted connections.  If some clients use 
unencrypted connections and some other clients use TLS-protected 
connections, then port 433 was to be used for unencrypted connections as 
well as connections using dynamic upgrade from unencrypted to 
TLS-protected traffic; and another port of its choice for strict TLS.
I agree it finally looks weird and inconsistent.

The rationale behind was:
- the common case is both reading&transit via port 119 (unencrypted, 
with possible use of STARTTLS), and strict TLS for reading via port 563;
- servers handling reading&transit on the same port can of course use 
strict TLS for transit via port 563;
- a few servers offer transit via port 433 (unencrypted, with possible 
use of STARTTLS), and keep ports 119/563 for reading.

Note that there is no IANA registered port for transit-only exchanges 
over TLS.  IANA registered ports are 119 (NNTP), 433 (NNSP) and 563 
(NNTP/TLS).


So I believe we have two alternatives right now:
a/ asking IANA to register a new port for NNSP/TLS and then explicitly 
say to use that port for transit with strict TLS;
b/ explicitly say to use another port than 433 for transit with strict TLS.

Alternative a/ is cleanest but maybe that new port will never be used in 
practice...
That's why I suggest b/ but of course I would be OK if a/ is chosen.
** Alexey, do you have any opinion about that?

Considering b/ (that I will adopt unless decided otherwise), the text 
becomes:

    TCP port 563 is dedicated to NNTP over TLS, and registered in the
    IANA Service Name and Transport Protocol Port Number Registry for
    that usage.  NNTP implementations using TCP port 563 begin the TLS
    negotiation immediately upon connection and then continue with the
    initial steps of an NNTP session.  This use of strict TLS on a
    separate port is the preferred way of using TLS with NNTP.

    If a host wishes to offer separate servers for transit and reading
    clients, TCP port 563 SHOULD be used for strict TLS with the reading
    server, and an unused port of its choice different than TCP port 433
    SHOULD be used for strict TLS with the transit server.  The ports
    used for strict TLS should be clearly communicated to the clients,
    and specifically that no plain-text communication occurs before the
    TLS session is negotiated.


I hope that's better in a security point of view (we do not rely on the 
quality of the configuration, and there cannot be any protocol switching 
attacks).

-- 
Julien ÉLIE

« – Poussez pas derrière !
   – Pas si vite devant ! » (Astérix)