Re: [secdir] [Jmap] Secdir last call review of draft-ietf-jmap-core-12

["Neil Jenkins" <[e-mail]>]

On Sat, 5 Jan 2019, at 9:10 AM, Ned Freed wrote:
> I'll first note that although the JMAP specification refers to the IMAP ACL
> security model extensively, RFC 4314 is not in the references list. That needs
> to be fixed,

Agreed, I have now added a reference to this.

>  and a note in the security considerations section saying that the
> security considerations for IMAP ACLs apply to JMAP would also be good.

I've read through the security considerations section here and I don't actually think any of them apply to JMAP; bear in mind the current spec does not have any way to set ACLs, it just exposes the user's current rights. (Setting ACLs is left to a future extension.)

---

I have added the following section to the JMAP Core security considerations:

*8.8 Push traffic analysis*

While the data is encrypted, a passive observer with the ability to monitor network traffic may be able to glean information from the timing of push notifications. For example, suppose an email or calendar invitation is sent from User A (hosted on Server X) to User B (hosted on Server Y). If Server X hosts data for many users, a passive observer can see that the two servers connected but does not know who the data was for. However, if a push notification is immediately sent to User B and the attacker can observe this as well, they may reasonably conclude that someone on Server X is connecting to User B.

This can be partially mitigated by the JMAP server applying some random jitter before sending out push notifications, however the jitter would have to be small so as not to affect quality of service. This is also mitigated inately on large services with high traffic flows hosting data for many users, as it becomes much harder for an attacker to correlate incoming data events with outgoing push notifications, allowing users to “hide in the crowd”.

---

I await the conclusion on whether we should add a confirmation step to push notifications, but other than that I don't believe there are any outstanding issues to address from this review. Please let me know if I've missed something.

Neil.