Subject: [xmpp] #79: use of SASL PLAIN over TLS

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 03:11:59 -0000

#79: use of SASL PLAIN over TLS
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  major               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Alexey Melnikov pointed to the following text in RFC 4954, which could
 provide a model for a warning about use of SASL PLAIN over TLS in XMPP:

 > 14. Additional Requirements When Using SASL PLAIN over TLS

 >  This section is normative for SMTP implementations that
 > support SASL [PLAIN] over [TLS].
 >
 > If an SMTP client is willing to use SASL PLAIN over TLS to
 > authenticate to the SMTP server, the client verifies the server
 > certificate according to the rules of [X509].  If the server
 > has not provided any certificate, or if the certificate
 > verification fails, the client MUST NOT attempt to authenticate
 > using the SASL PLAIN mechanism.
 >
 > After a successful [TLS] negotiation, the client MUST check
 > its understanding of the server hostname against the server's
 > identity as presented in the server Certificate message, in
 > order to prevent man-in-the-middle attacks.  If the match
 > fails, the client MUST NOT attempt to authenticate using the
 > SASL PLAIN mechanism.

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/79>
xmpp <http://tools.ietf.org/xmpp/>

---

From: "xmpp issue tracker" <[email-masked]>
Date: Wed, 23 Jun 2010 21:56:09 -0000

#79: use of SASL PLAIN over TLS
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  major               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Addressed via the following text:

    If the initiating entity (typically a client) is willing to use SASL
    PLAIN over TLS to authenticate to an XMPP server, it MUST verify the
    server certificate.  If the server has not provided any certificate,
    or if certificate validation fails (as described under
    Section 13.7.2), the initiating entity MUST NOT attempt to
    authenticate using the SASL PLAIN mechanism.  After a successful TLS
    negotiation, the initiating entity MUST check its understanding of
    the server hostname against the server's identity as presented in the
    TLS Certificate message, in order to prevent man-in-the-middle
    attacks.  If the match fails, the client MUST NOT attempt to
    authenticate using the SASL PLAIN mechanism.  Server identity
    matching MUST follow the rules specified in [TLS-CERTS].

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/79#comment:1>
xmpp <http://tools.ietf.org/xmpp/>