Subject: Proposed text for adaptive plaintext attacks

From: [email-masked] (Sam Hartman)
Date: Mon, 12 Apr 2004 14:37:16 -0400 (EDT)

I propose to replace the following text in section 9:

    Distributed server implementations need to be careful in how they
    trust other parties and, in particular, authentication secrets should
    only be disclosed to other parties that are trusted to manage and use
    those secrets in manner acceptable to disclosing party.  It should be
    noted that, where those secrets are used to provide data
    confidentiality protections, if a third party (other than the
    discloser/disclosee) has knowledge of some portion of the protected
    information, it can use this knowledge in an attack upon other
    portions of the protected information.

    <<Section 6.3.1 contains a description of a potential class of attack
    on a distributed server implementation. The section also gives some
    recommendations about mitigating such attacks.>>

with the following text:

    Distributed server implementations need to be careful in how they
    trust other parties and, in particular, authentication secrets should
    only be disclosed to other parties that are trusted to manage and use
    those secrets in manner acceptable to disclosing party.  

 Applications using SASL assume that SASL security layers providing
 confidentiality are secure even when an attacker chooses the text to
 be protected by the security layer.  Similarly applications assume
 that the SASL security layer is secure even if the attacker can
 manipulate the ciphertext output of the security layer.  With the
 exception of the DES modes of the digest-md5 mechanism, all SASL
 mechanisms standardized by the IETF are believed to meet these
 security assumptions.  New SASL mechanisms MUST meet these assumptions.

Do people feel that explicit text about security considerations of CBC
belong in the base SASL specification?

--Sam