IETF Logo Mail Archive

Re: [secdir] sec-dir review of draft-ietf-sieve-autoreply-02

Derek Atkins <derek@ihtfp.com> Fri, 03 December 2010 13:46 UTC

Return-Path: <derek@ihtfp.com>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC51F28C0E9; Fri, 3 Dec 2010 05:46:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.988
X-Spam-Level:
X-Spam-Status: No, score=-101.988 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_ORG=0.611, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-8mJrvob3vt; Fri, 3 Dec 2010 05:46:43 -0800 (PST)
Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) by core3.amsl.com (Postfix) with ESMTP id 8771528C0ED; Fri, 3 Dec 2010 05:46:43 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id 5FB8C2602AB; Fri, 3 Dec 2010 08:47:56 -0500 (EST)
Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 27377-03; Fri, 3 Dec 2010 08:47:51 -0500 (EST)
Received: from pgpdev.ihtfp.org (IHTFP-DHCP-100.IHTFP.ORG [192.168.248.100]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "cliodev.ihtfp.com", Issuer "IHTFP Consulting Certification Authority" (not verified)) by mail2.ihtfp.org (Postfix) with ESMTPS id A4B6B260245; Fri, 3 Dec 2010 08:47:51 -0500 (EST)
Received: (from warlord@localhost) by pgpdev.ihtfp.org (8.14.4/8.14.3/Submit) id oB3DlYUD020322; Fri, 3 Dec 2010 08:47:34 -0500
From: Derek Atkins <derek@ihtfp.com>
To: Barry Leiba <barryleiba@computer.org>
References: <sjmhbex9pqe.fsf@pgpdev.ihtfp.org> <AANLkTi=Lyr47Nk9EZfpZYPnvXAgp-TCj-+RHar6oSPwM@mail.gmail.com>
Date: Fri, 03 Dec 2010 08:47:34 -0500
In-Reply-To: <AANLkTi=Lyr47Nk9EZfpZYPnvXAgp-TCj-+RHar6oSPwM@mail.gmail.com> (Barry Leiba's message of "Wed, 1 Dec 2010 16:09:12 -0500")
Message-ID: <sjmmxon7ytl.fsf@pgpdev.ihtfp.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.2a
Cc: robinsgv@gmail.com, Alexey.Melnikov@isode.com, sieve-chairs@tools.ietf.org, iesg@ietf.org, secdir@ietf.org
Subject: Re: [secdir] sec-dir review of draft-ietf-sieve-autoreply-02
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Dec 2010 13:46:44 -0000

Hi,

Barry Leiba <barryleiba@computer.org> writes:

> Hi, Derek, and thanks for the review.
>
>> The security considerations section details many potential issues with
>> automated responders.  One attack that it does not mention is the
>> potential for using the auto-responder as an oracle, in particular if
>> the system is using any public key cryptographic methods.  An attacker
>> could, theoretically, use the auto-responder to perform timing attacks.
>
> You mean, as a covert channel?
>
> The "probing" paragraph isn't sufficient to cover that as well? (It
> doesn't focus on covert channels, but does talk about probing for
> presence changes.)

I wasn't specifically thinking about covert channels.  I was more
thinking about cases where the autoresponder could perform some
operation on behalf of an attacker and return the results.  For example,
I would be concerned if the auto-responder returned the result of a DKIM
verification, or perhaps an OpenPGP or S/MIME decryption.  I'm thinking
about this more as a cryptographic oracle, not necessarily an IMPP
oracle.

> Barry

-derek

-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant

v2.23.0 | Report a Bug | By Email