Subject: [Uta] Richard Barnes' No Objection on draft-ietf-uta-tls-attacks-04: (with COMMENT)

From: "Richard Barnes" <[email-masked]>
Date: Wed, 15 Oct 2014 18:50:26 -0700

Richard Barnes has entered the following ballot position for
draft-ietf-uta-tls-attacks-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-uta-tls-attacks/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

It might be useful to note that SSL stripping is a flavor of downgrade
attack.  Likewise, it could be worth noting in this section or Section
2.2 that STARTTLS is very vulnerable to downgrade without some sort of
HSTS-like mechanism.  For example, there's some recent evidence of
downgrade attacks on mail protocols.  

Downgrade in general could use more attention.  The IETF can fix things
in newer versions of the protocol, but if the client and server can't
negotiate that version, it's all for naught.

https://www.techdirt.com/blog/netneutrality/articles/20141012/06344928801/revealed-isps-already-violating-net-neutrality-to-block-encryption-make-everyone-less-safe-online.shtml

Given the news about POODLE this week, I would suggest changing Section
2.4 to be "Padding Oracle Attacks", and adding POODLE there.

I'm surprised not to see some mention of Heartbleed in Section 2.13.

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 19 Oct 2014 18:48:40 +0300

Hi Richard,

Please see in-line.

Thanks,
	Yaron

> http://datatracker.ietf.org/doc/draft-ietf-uta-tls-attacks/

Agree on the above and thanks for the link. It is scary indeed that ISPs 
actively MITM SMTP traffic to prevent opportunistic encryption from 
taking place.

> 2.4 to be "Padding Oracle Attacks", and adding POODLE there.

We will look into this, I'm still not sure where to fit the new dog.

> I'm surprised not to see some mention of Heartbleed in Section 2.13.

Good idea.
>
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 19 Oct 2014 19:29:35 +0000

On Sun, Oct 19, 2014 at 06:48:40PM +0300, Yaron Sheffer wrote:

> actively MITM SMTP traffic to prevent opportunistic encryption from taking
> place.

This looks exactly like the off-the-shelf Cisco ESA (formerly PIX)
firewall SMTP inspection feature.  If the ISP is using that product,
the filtering in question may even be inadvertent (out of the box
default policy).  So it may be a bit early to conclude a grand
conspiracy here.

-- 
	Viktor.

---

From: Aaron Zauner <[email-masked]>
Date: Sun, 19 Oct 2014 21:36:17 +0200

>> I'm surprised not to see some mention of Heartbleed in Section 2.13.

Hmm. Yes, that was quite serious. But there have been an abundance of
implementation flaws. What do we add and what do we omit from the document?

Examples:
https://eprint.iacr.org/2011/232.pdf
http://www.win.tue.nl/hashclash/rogue-ca/
http://www.thoughtcrime.org/papers/null-prefix-attacks.pdf
https://www2.dcsec.uni-hannover.de/files/fc14_unused_cas.pdf
https://www.cs.utexas.edu/~shmat/shmat_oak14.pdf
...

Aaron

---

From: Eliot Lear <[email-masked]>
Date: Sun, 19 Oct 2014 22:27:01 +0200

On 10/19/14, 9:29 PM, Viktor Dukhovni wrote:
> firewall SMTP inspection feature.

The ESA is an MTA, and can play the role of an MSA.  It's not a packet
processing firewall.

Eliot