Subject: Re: [Extra] I-D Action: draft-ietf-extra-imap4rev2-25.txt

From: Alexey Melnikov <[email-masked]>
Date: Mon, 15 Feb 2021 12:16:12 +0000

Hi all,

On 20/01/2021 18:44, [email-masked] wrote:

> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-extra-imap4rev2/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-extra-imap4rev2-25
> https://datatracker.ietf.org/doc/html/draft-ietf-extra-imap4rev2-25
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-extra-imap4rev2-25

I know I am doing this out of the order, but I missed summarizing 
changes in this revision, which are pretty significant:

1) Clarified that the list of capabilities can change after STARTTLS, 
AUTHENTICATE, LOGIN.

2) Added prohibition to use ALERT before STARTTLS/SASL security layer, 
as this can be used by MITM attackers against clients.

3) Added a new requirements on clients that require TLS when they see 
PREAUTH on a cleartext port. As PREAUTH response forces the client to 
bypass STARTTLS command, such clients are required to close the connection.

4) Added a new Security Consideration subsection talking about 
unsolicited responses received in wrong states and that clients must 
ignore them. For example, LIST received before autentication must be 
ignored. Similar EXISTS/FLAGS/FETCH received when there is no mailbox 
selected.

5) Added new requirement that servers MUST implement implicit TLS port 
handling (993) and SHOULD implement cleartext port with STARTTLS. 
(Clients MUST implement both.) This seems to match what many ISPs are doing.

6) Added missing IANA registrations.

7) Some minor ABNF clarifications (added pointers for some ABNF 
productions imported from other documents).

8) Some minor wording changes for clarity.

Best Regards,

Alexey