Subject: Moving forward with CRAM-MD5

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 13 Jun 2008 09:14:12 -0700

First, the chairs apologize to the WG for the dropping the ball with  
regards to this work item, and to especially to Frank for not  
responding to his comments to the last CRAM-MD5 WGLC (March 2007).

While the WG was chartered to produce a CRAM-MD5 suitable for  
progression on the Standard Track, the WG has mostly taken a "document  
current practice" approach.  Given this approach and the I-D it  
produced, progression as Informational would be more appropriate.    
For instance, the choice of SHOULD use Unicode, SASLprep, UTF-8 for  
the shared-secret than a MUST seems more appropriate for a  
Informational document documenting current practice than the Standard  
Track trying to ensure interoperability between implementations of the  
specification.

As I do not believe there is sufficient desire or energy to adequately  
address known problems, and a strong desire to publish this document  
largely "as is", I recommend the I-D's intended category be  
"Informational" (to be reflected in the I-Ds header).  I also propose  
the following statement be added to the bottom of the "Introduction"  
section (section 1):
   This document replaces RFC 2195.  Furthermore, RFC 2195 is (on  
approval of this I-D as an RFC) moved to Historic status.

I note that moving a specification off the standards track is  
appropriate when it has fallen into some disfavor.  While use of CRAM- 
MD5 remains prevalent on the Internet, it seems unlikely that the IETF  
would, if considered anew, standardize such at this time.  The IETF  
now seems to favor standardization of mechanisms which provide better  
internationalization and additional security features.

With regards to Frank's comments, I recall each being viewed, for one  
reason or another, as not requiring further changes to the I-D.    
However, because of the delay, and the lack of a specific response to  
his comments, I would like to now give Frank and others the  
opportunity to raise any concerns they might have with regard to this  
document.   (The chairs shall, where appropriate, state whether any  
raised issue is closed and why.)  Hence, it is my intent to subject  
this I-D to another WG last call shortly after the revised I-D is  
announced.

-- Kurt (as SASL WG co-chair)

---

From: Chris Newman <[email-masked]>
Date: Mon, 23 Jun 2008 23:37:00 -0700

At this point, I support any action which gets a CRAM-MD5 revision 
published as long as it includes the appropriate parsing advice related to 
spaces in usernames.

		- Chris

--On June 13, 2008 9:14:12 -0700 Kurt Zeilenga <[email-masked]> 
wrote:
> regards to this work item, and to especially to Frank for not responding
> to his comments to the last CRAM-MD5 WGLC (March 2007).
>
> While the WG was chartered to produce a CRAM-MD5 suitable for progression
> on the Standard Track, the WG has mostly taken a "document current
> practice" approach.  Given this approach and the I-D it produced,
> progression as Informational would be more appropriate.   For instance,
> the choice of SHOULD use Unicode, SASLprep, UTF-8 for the shared-secret
> than a MUST seems more appropriate for a Informational document
> documenting current practice than the Standard Track trying to ensure
> interoperability between implementations of the specification.
>
> "Informational" (to be reflected in the I-Ds header).  I also propose the
> following statement be added to the bottom of the "Introduction" section
> (section 1):
> I note that moving a specification off the standards track is appropriate
> when it has fallen into some disfavor.  While use of CRAM-MD5 remains
> prevalent on the Internet, it seems unlikely that the IETF would, if
> considered anew, standardize such at this time.  The IETF now seems to
> favor standardization of mechanisms which provide better
> However, because of the delay, and the lack of a specific response to his
> comments, I would like to now give Frank and others the opportunity to
> raise any concerns they might have with regard to this document.   (The
> chairs shall, where appropriate, state whether any raised issue is closed
> and why.)  Hence, it is my intent to subject this I-D to another WG last
> call shortly after the revised I-D is announced.

Date: Mon, 23 Jun 2008 23:37:00 -0700
From: Chris Newman <[email-masked]>
Subject: Re: Moving forward with CRAM-MD5
To: Kurt Zeilenga <[email-masked]>, [email-masked]
Sender: [email-masked]

At this point, I support any action which gets a CRAM-MD5 revision 
published as long as it includes the appropriate parsing advice related to 
spaces in usernames.

		- Chris

--On June 13, 2008 9:14:12 -0700 Kurt Zeilenga <[email-masked]> 
wrote:
> regards to this work item, and to especially to Frank for not responding
> to his comments to the last CRAM-MD5 WGLC (March 2007).
>
> While the WG was chartered to produce a CRAM-MD5 suitable for progression
> on the Standard Track, the WG has mostly taken a "document current
> practice" approach.  Given this approach and the I-D it produced,
> progression as Informational would be more appropriate.   For instance,
> the choice of SHOULD use Unicode, SASLprep, UTF-8 for the shared-secret
> than a MUST seems more appropriate for a Informational document
> documenting current practice than the Standard Track trying to ensure
> interoperability between implementations of the specification.
>
> "Informational" (to be reflected in the I-Ds header).  I also propose the
> following statement be added to the bottom of the "Introduction" section
> (section 1):
> I note that moving a specification off the standards track is appropriate
> when it has fallen into some disfavor.  While use of CRAM-MD5 remains
> prevalent on the Internet, it seems unlikely that the IETF would, if
> considered anew, standardize such at this time.  The IETF now seems to
> favor standardization of mechanisms which provide better
> However, because of the delay, and the lack of a specific response to his
> comments, I would like to now give Frank and others the opportunity to
> raise any concerns they might have with regard to this document.   (The
> chairs shall, where appropriate, state whether any raised issue is closed
> and why.)  Hence, it is my intent to subject this I-D to another WG last
> call shortly after the revised I-D is announced.

From: Kurt Zeilenga <[email-masked]>
To: [email-masked]
Subject: Moving forward with CRAM-MD5
Date: Fri, 13 Jun 2008 09:14:12 -0700
Sender: [email-masked]

Date: Wed, 11 Jun 2008 09:40:48 +0800
From: ybjiang <[email-masked]>
To: [email-masked]
Subject: Re:
Sender: [email-masked]

------=_Part_32195_3259400.1213148448504
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

unsubscribe

------=_Part_32195_3259400.1213148448504
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

unsubscribe<br><br>

------=_Part_32195_3259400.1213148448504--

Content-class: urn:content-classes:message
Subject: 
Date: Tue, 10 Jun 2008 18:14:57 +0200
From: "Rocco Scappatura" <[email-masked]>
To: <[email-masked]>
Sender: [email-masked]

unsubscribe

Content-class: urn:content-classes:message
Subject: RE: Authenticated SMTP using CYRUS SASL and MD5 crypted password on         MySQL
Date: Tue, 10 Jun 2008 18:14:38 +0200
From: "Rocco Scappatura" <[email-masked]>
To: "Kurt Zeilenga" <[email-masked]>
Cc: <[email-masked]>
Sender: [email-masked]

> The ietf-sasl mailing list is for discussions concerning the=20
> standardization of SASL and other work of the IETF SASL=20
> Working Group.  Discussions specific to any particular=20
> implementation of SASL, such as Cyrus SASL, are more=20
> appropriately directed to a support forum for that=20
> implementation.  There is a Cyrus SASL forum available at:
>     http://lists.andrew.cmu.edu/mailman/listinfo/cyrus-sasl
>=20
> Regards, Kurt (IETF SASL WG co-chair)
Thanks,

sorry.

rocsca

Cc: [email-masked]
From: Kurt Zeilenga <[email-masked]>
To: Rocco Scappatura <[email-masked]>
Subject: Re: Authenticated SMTP using CYRUS SASL and MD5 crypted password on MySQL
Date: Tue, 10 Jun 2008 09:12:49 -0700
Sender: [email-masked]

The ietf-sasl mailing list is for discussions concerning the  
standardization of SASL and other work of the IETF SASL Working  
Group.  Discussions specific to any particular implementation of SASL,  
such as Cyrus SASL, are more appropriately directed to a support forum  
for that implementation.  There is a Cyrus SASL forum available at:
    http://lists.andrew.cmu.edu/mailman/listinfo/cyrus-sasl

Regards, Kurt (IETF SASL WG co-chair)

On Jun 10, 2008, at 2:22 AM, Rocco Scappatura wrote:

>
> Hello,
>
> I'm configuring SMTP authenticated service in Postifix. I have  
> installed
> CYRUS SASL libraries 2.1.22 and rebuilded Postfix with CYRUS SASL
> support:
>
> # find /usr -name 'libsasl*.*'
> /usr/local/lib/sasl2/libsasldb.so.2.0.22
> /usr/local/lib/sasl2/libsasldb.so.2
> /usr/local/lib/sasl2/libsasldb.so
> /usr/local/lib/sasl2/libsasldb.la
> /usr/local/lib/libsasl2.so.2.0.22
> /usr/local/lib/libsasl2.so.2
> /usr/local/lib/libsasl2.so
> /usr/local/lib/libsasl2.la
>
> Note that I'm using Postfix+MySQL and that password are stored in
> mailbox table in MD5 format.
>
> I've configured SMTP for CYRUS SASL:
>
> # smtpd.conf
> pwcheck_method: auxprop
> auxprop_plugin: sql
> mech_list: plain login
>
> sql_engine: mysql
> sql_hostnames: 127.0.0.1
> sql_user: postfix
> sql_passwd: ****
> sql_database: postfix
> sql_format: crypt
> sql_select: select password from mailbox where name='%u' or
> username='%u'
> sql_verbose: yes
>
> But I still cant authenticate for authenticated SMTP:
>
> # telnet 127.0.0.1 25
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> 220 av7.sttspa.it
> ehlo sttspa.it
> 250-av7.sttspa.it
> 250-PIPELINING
> 250-SIZE 35840000
> 250-VRFY
> 250-ETRN
> 250-AUTH LOGIN PLAIN
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN
> AUTH PLAIN AGRlYnVnAGRlYnVn
> 535 5.7.8 Error: authentication failed: authentication failure
>
> I'm sure that I'm wrong in something, but I can't understand what:
>
> Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning: SASL authentication
> failure: Password veri fication failed
> Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning:  
> localhost[127.0.0.1]:
> SASL PLAIN authentic ation failed: authentication failure
>
> Any hint is apprecciated.
>
> Tnx,
>
> rocsca
>

Content-class: urn:content-classes:message
Subject: RE:  Re: Authenticated SMTP using CYRUS SASL and MD5 crypted password on MySQL
Date: Tue, 10 Jun 2008 18:06:23 +0200
From: "Rocco Scappatura" <[email-masked]>
To: "Frank Ellermann" <[email-masked]>, <[email-masked]>
Sender: [email-masked]

> I've no idea what that is, is it the weird format starting=20
> with $apr1$ or $1$ ?  With AUTH PLAIN <off topic=3D"sasl"> and=20
> AUTH LOGIN </off> you get or send passwords as plain text, as=20
> the name says.
>=20

OK. Then, is the any way to tell to CYRUS that the password are stored
on a table of a MySQL DB in MD5 format (Base64)?

> > AUTH PLAIN AGRlYnVnAGRlYnVn
> > 535 5.7.8 Error: authentication failed: authentication failure
>=20
> The server isn't supposed to offer PLAIN outside of TLS, and=20
> if it offers PLAIN anyway the client isn't supposed to use it. =20
>=20
> <off topic=3D"sasl"> Try AUTH LOGIN </off>, see also=20
> <http://www.technoids.org/saslmech.html>.  If that also fails=20
> the issue might be your "MD5 format" (?)
>=20
> Maybe test the part after the third "$" instead of "debug"=20
> for the $apr1$whatever$wannabecrypt format.
>=20
>  Frank
>=20
>=20

To: [email-masked]
From:  "Frank Ellermann" <[email-masked]>
Subject:  Re: Authenticated SMTP using CYRUS SASL and MD5 crypted password on MySQL
Date:  Tue, 10 Jun 2008 16:56:51 +0200
Organization:  <http://purl.net/xyzzy>
Lines: 24
Reply-To:  "Frank Ellermann" <[email-masked]>
Sender: [email-masked]

Rocco Scappatura wrote:

> password are stored in mailbox table in MD5 format.

I've no idea what that is, is it the weird format=20
starting with $apr1$ or $1$ ?  With AUTH PLAIN=20
<off topic=3D"sasl"> and AUTH LOGIN </off> you get
or send passwords as plain text, as the name says.

> AUTH PLAIN AGRlYnVnAGRlYnVn
> 535 5.7.8 Error: authentication failed: authentication failure

The server isn't supposed to offer PLAIN outside of=20
TLS, and if it offers PLAIN anyway the client isn't
supposed to use it. =20

<off topic=3D"sasl"> Try AUTH LOGIN </off>, see also
<http://www.technoids.org/saslmech.html>.  If that
also fails the issue might be your "MD5 format" (?)

Maybe test the part after the third "$" instead of
"debug" for the $apr1$whatever$wannabecrypt format.

 Frank

Content-class: urn:content-classes:message
Subject: Authenticated SMTP using CYRUS SASL and MD5 crypted password on MySQL
Date: Tue, 10 Jun 2008 11:22:23 +0200
From: "Rocco Scappatura" <[email-masked]>
To: <[email-masked]>, <[email-masked]>
Sender: [email-masked]

Hello,

I'm configuring SMTP authenticated service in Postifix. I have installed
CYRUS SASL libraries 2.1.22 and rebuilded Postfix with CYRUS SASL
support:

# find /usr -name 'libsasl*.*'
/usr/local/lib/sasl2/libsasldb.so.2.0.22
/usr/local/lib/sasl2/libsasldb.so.2
/usr/local/lib/sasl2/libsasldb.so
/usr/local/lib/sasl2/libsasldb.la
/usr/local/lib/libsasl2.so.2.0.22
/usr/local/lib/libsasl2.so.2
/usr/local/lib/libsasl2.so
/usr/local/lib/libsasl2.la

Note that I'm using Postfix+MySQL and that password are stored in
mailbox table in MD5 format.

I've configured SMTP for CYRUS SASL:

# smtpd.conf
pwcheck_method: auxprop
auxprop_plugin: sql
mech_list: plain login

sql_engine: mysql
sql_hostnames: 127.0.0.1
sql_user: postfix
sql_passwd: ****
sql_database: postfix
sql_format: crypt
sql_select: select password from mailbox where name=3D'%u' or
username=3D'%u'
sql_verbose: yes

But I still cant authenticate for authenticated SMTP:

 # telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 av7.sttspa.it
ehlo sttspa.it
250-av7.sttspa.it
250-PIPELINING
250-SIZE 35840000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH PLAIN AGRlYnVnAGRlYnVn
535 5.7.8 Error: authentication failed: authentication failure

I'm sure that I'm wrong in something, but I can't understand what:

Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning: SASL authentication
failure: Password veri fication failed
Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning: localhost[127.0.0.1]:
SASL PLAIN authentic ation failed: authentication failure

Any hint is apprecciated.

Tnx,

rocsca