Subject: [xmpp] SASL transition-needed

From: Dave Cridland <[email-masked]>
Date: Tue, 08 Jun 2010 14:17:29 +0100

Philip Hancke raised some interesting points to me in private:

[13:53:45] Fippo: hey sasl guy... can you explain me why my client  
should warn me about a transition-needed only if the connection is  
not secure? I would somehow expect my client to warn me that the  
server wants my plaintext password even when using a secure connection
[13:54:48] Fippo: (I am wondering about the text at the end of  
section 6.4.12)

He's quite right - the text implies that as long as you have TLS,  
this is all fine. Nowhere in either this memo, or in RFC 4422, is the  
security implications of transition-needed discussed.

It's a great way to get a downgrade attack, defeating the advice in  
RFC 4422 on countering these almost perfectly.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Florian Zeitz <[email-masked]>
Date: Tue, 08 Jun 2010 17:06:07 +0200

On 08.06.2010 15:17, Dave Cridland wrote:
> should warn me about a transition-needed only if the connection is not
> secure? I would somehow expect my client to warn me that the server
> wants my plaintext password even when using a secure connection
> [13:54:48] Fippo: (I am wondering about the text at the end of section
> 6.4.12)
> 
> He's quite right - the text implies that as long as you have TLS, this
> is all fine. Nowhere in either this memo, or in RFC 4422, is the
> It's a great way to get a downgrade attack, defeating the advice in RFC
> 4422 on countering these almost perfectly.
> 
> Dave.

I tend to agree, however in reality this mean you'll always want to warn
the user when using PLAIN. Downgrade attacks of this sort can also be
performed by modifying the offered mechanisms and section 13 only
mentions the use of TLS as a prevention mechanism for this too.

--
Florian Zeitz

---

From: Dave Cridland <[email-masked]>
Date: Tue, 08 Jun 2010 16:30:32 +0100

On Tue Jun  8 16:06:07 2010, Florian Zeitz wrote:
> section
> this

I suppose if you do TLS as the specification suggests, you're  
relatively safe (unless the attacker has subverted the server and is  
now just fishing for your password to check on other services).

Dave.