Re: [secdir] secdir review of draft-elie-nntp-tls-recommendations-01

[Julien ÉLIE <[e-mail]>]

Hi David,

> I think this document is ready with nits.

Many thanks for having taken the time to review the document.


> Section 2.4: I think the second to last bullet (about lack of STARTTLS)
> should be expanded in scope to say "during any previous connection
> within a (possibly configurable) time frame" instead of "during the
> previous connection." Otherwise, a human might not see the warning the
> first time, and the warning would disappear immediately after that.

Oh, you're totally right.  That's a pretty good catch.
I've adopted your wording in the future revised I-D.



Incidentally, I would like to point out that I received in the 
(concluded) IETF NNTP a suggestion of answer for the 3rd question in 
Appendix E:
   https://lists.eyrie.org/pipermail/ietf-nntp/2016-November/006249.html
   https://lists.eyrie.org/pipermail/ietf-nntp/2016-December/006251.html

FYI, the use of ports 119 and 433 is described in Sections 3.4.1 and 
3.4.2 of RFC 3977:

     The official TCP port for the NNTP service is 119.  However, if a
     host wishes to offer separate servers for transit and reading
     clients, port 433 SHOULD be used for the transit server and 119 for
     the reading server.


I believe it is OK to take the following text into account for the ports 
to use for NNTP over TLS, but I prefer to share with you the wording in 
case you have any comments about it.  (Maybe it is not clear enough!)
We would then have in Appendix A of the document:

  The third and fourth paragraphs in Section 1 of [RFC4642] are
  replaced with the following text:

   TCP port 563 is dedicated to NNTP over TLS, and registered in the
   IANA Service Name and Transport Protocol Port Number Registry for
   that usage.  NNTP implementations using TCP port 563 begin the TLS
   negotiation immediately upon connection and then continue with the
   initial steps of an NNTP session.  This use of strict TLS on a
   separate port is the preferred way of using TLS with NNTP.

   If a host wishes to offer separate servers for transit and reading
   clients, TCP port 563 SHOULD be used for the reading server using
   strict TLS.  If a transit server offers strict TLS, it SHOULD use TCP
   port 433 if it does not accept unencrypted connections, but can
   alternatively use another unused port of its choice.  If it accepts
   dynamic upgrade from unencrypted to TLS-protected traffic, it SHOULD
   use TCP port 433 for that usage, and another unused port of its
   choice for strict TLS.  In either case, the port used for strict TLS
   should be clearly communicated to the client, and specifically that
   no plain-text communication occurs before the TLS session is
   negotiated.


-- 
Julien ÉLIE

« – Et si vous ne trouvez pas, je vous fais bouillir et servir aux
     lions avec de la sauce à la menthe !!!
   – Mais c'est horrible ça !
   – Oui, pauvres bêtes ! » (Astérix)