Subject: comments on draft-ietf-sasl-anon-00

From: Philip Guenther <[email-masked]>
Date: Wed, 19 Feb 2003 23:54:04 -0800

The syntax for UTF-8 characters in the draft permits "non-shortest form"
encodings and encodings for characters outside the range of the Unicode
character set.  Neither may be interpreted by a program conforming to
the Unicode 3.2 specification, which the draft references.

Paragraph 5 of section 4 (security consideration), suggests the use of
an idle timeout on servers that place a limit on the number of
concurrent anonymous users in order to combat a denial-of-service
attack.  As keeping a connection from being considered idle will
generally require simply sending a request (possibly even a malformed
request), it's unlikely that an idle timeout will actually prevent an
intentional DOS attack from succeeding.  A hard timeout on connection
duration, network access limitations, or (where appropriate) a limit on
the number of requests permitted on an anonymous connection may be
required to provide a minimal service guarantee in the face of malicious
access.

The ANONYMOUS mechanism does not provide a means for the client to
supply an optional realm in which the anonymous authentication should
take place.  This makes the ANONYMOUS mechanism unusable by servers that
support multiple realms on a single communication end-point; it cannot
supplant the "anonymous@domain" login supported by, for example, some
IMAP servers.

Philip Guenther