Subject: CAP: SASL mechanisms and MITM attacks

From: John Stracke <[email-masked]>
Date: Thu, 16 Aug 2001 14:33:27 -0400

CAP section 7.1.3 discusses the risk of an attacker forcing the client 
to pick a weak SASL mechanism. It says that the CUA should fetch the 
list of supported mechanisms after authenticating, to make sure it 
hasn't changed. First: it's not clear to me how this fetch would be 
done; can we spell it out? Second: does this actually do any good? Can't 
the man-in-the-middle change the list of supported mechanisms after 
authenticating, as well as before?

-- 
/==============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.|
|Chief Scientist |=============================================|
|eCal Corp.      |This space intentionally left blank.         |
[email-masked] <mailto:[email-masked]>|                                             |
\==============================================================/

---

From: Lawrence Greenfield <[email-masked]>
Date: Thu, 16 Aug 2001 14:59:53 -0400

This is only useful if integrity or privacy protection were
negotiated.

Clients MUST have minimal acceptable security parameters to avoid the
active attacker problem.

Larry

   Date: Thu, 16 Aug 2001 14:33:27 -0400
   From: John Stracke <[email-masked]>
   Organization: eCal Corporation

---

From: George Babics <[email-masked]>
Date: Tue, 21 Aug 2001 13:52:44 -0400

John Stracke wrote:
> to pick a weak SASL mechanism. 

  Where does it say it in 7.1.3? Perhaps it is in another section?
Or is it simply implied?

> It says that the CUA should fetch the
> done; can we spell it out? 

  Use the CAPABILITIES command.

> Second: does this actually do any good? Can't

  It probably does not help. Perhaps the solution it say use
a weak SASL mechanisms at your own risk? People concerned with
security will make sure their clients use strong methods.
Is this acceptable? Paul?

George

---

From: John Stracke <[email-masked]>
Date: Tue, 21 Aug 2001 14:07:43 -0400

George Babics wrote:

>  Where does it say it in 7.1.3?
>
It's the paragraph starting "If a SASL security layer is negotiated...".

>  Use the CAPABILITIES command.
OK, now I see; but it wasn't clear when I read it before.

>security will make sure their clients use strong methods.
Probably best, yes.

|eCal Corp.      |Help stamp out vi in our lifetime!           |
[email-masked]|                                             |