Subject: Re: Last Call: draft-siemborski-rfc2554bis (SMTP Service Extension for Authentication) to Proposed Standard

From: Philip Guenther <[email-masked]>
Date: Wed, 24 Jan 2007 20:15:05 -0700

On Wed, 24 Jan 2007, The IESG wrote:
> The IESG has received a request from an individual submitter to consider
> the following document:
>
> - 'SMTP Service Extension for Authentication '
>   <draft-siemborski-rfc2554bis-07.txt> as a Proposed Standard

draft-siemborski-rfc2554bis does not appear to contain any text similar to 
the last paragraph of section 4 in the rfc1734bis draft, requiring servers 
to support a configuration that does not permit passive password snooping.

I disagree with the choice of DIGEST-MD5 as the mandatory-to-implement 
mechanism.  Given that many of the other protocols likely to be used by an 
SMTP client, such as POP3, IMAP4rev1, and LDAP, have chosen to specify 
"TLS followed by a cleartext password authentication" as their MtI 
authentication method, specifying DIGEST-MD5 here seems like a needless 
difference.  I see no reason to believe DIGEST-MD5 will be more deployable 
in SMTP/submission servers than in IMAP, POP3, or LDAP servers.

Philip Guenther

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Lisa Dusseault <[email-masked]>
Date: Fri, 26 Jan 2007 14:55:37 -0800

Hi Philip, thanks for the review.  But are we looking at the same  
version of this doc?  We dealt with this after doing a pseudo-WG-last- 
call on the SMTP mailing list and the -07 draft now has:

           To ensure interoperability, client and server implementations
           of this extension MUST implement the [PLAIN] SASL mechanism.

           Note: a server implementation MUST implement a configuration
           in which it does NOT permit any plaintext password  
mechanisms,
           unless either the STARTTLS [SMTP-TLS] command has been
           negotiated or some other mechanism that protects the session
           from password snooping has been provided.  Server sites  
SHOULD
           NOT use any configuration which permits a plaintext password
           mechanism without such a protection mechanism against  
password
           snooping.

Lisa

On Jan 24, 2007, at 7:15 PM, Philip Guenther wrote:

> draft-siemborski-rfc2554bis does not appear to contain any text  
> similar to the last paragraph of section 4 in the rfc1734bis draft,  
> requiring servers to support a configuration that does not permit  
> passive password snooping.
>
> I disagree with the choice of DIGEST-MD5 as the mandatory-to- 
> implement mechanism.  Given that many of the other protocols likely  
> to be used by an SMTP client, such as POP3, IMAP4rev1, and LDAP,  
> have chosen to specify "TLS followed by a cleartext password  
> authentication" as their MtI authentication method, specifying  
> DIGEST-MD5 here seems like a needless difference.  I see no reason  
> to believe DIGEST-MD5 will be more deployable in SMTP/submission  
> servers than in IMAP, POP3, or LDAP servers.
>
>
> Philip Guenther
>

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 27 Jan 2007 01:54:44 +0100

Lisa Dusseault wrote:

> are we looking at the same version of this doc?

No, the last called is -07, it doesn't REQUIRE [DIGEST-MD5] anymore:

| Note that many existing client and server implementations implement
| CRAM-MD5 [CRAM-MD5] SASL mechanism. In order to insure interoperability
| with deployed software new implementations MAY implement it, however
| implementations should be aware that this SASL mechanism doesn't
| provide any server authentication. Implementations that want to provide
| server authentication are encouraged to implement SASL mechanisms such
| as DIGEST-MD5 [DIGEST-MD5].

The MAY is a bit obscure, of course they MAY do this, optionally.  I'd
prefer a clearer SHOULD to s/insure/ensure/ (?) interoperability.  It
has references to 2195 and 2831bis, and talks about SASLprep.  How about
using 2195bis, its "security considerations" might be more up to date ?

The question of the 2195bis status (draft standard vs. informational)
will be interesting, but it won't affect 2554bis, and maybe we'll find
a compromise between those positions.

Frank

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 27 Jan 2007 18:24:01 +0000

Frank Ellermann wrote:

>prefer a clearer SHOULD to s/insure/ensure/ (?) interoperability.
>
I didn't want to recommend it, but at the same time I wanted to let 
people know that CRAM-MD5 is deployed.
If other people feel strongly about changing the MAY to the SHOULD, I 
will do the change.

>It has references to 2195 and 2831bis, and talks about SASLprep.  How about
I will be glad to reference 2195bis if it gets published soon enough. 
This change can be done during AUTH48.

---

From: Philip Guenther <[email-masked]>
Date: Fri, 26 Jan 2007 18:11:20 -0700

On Fri, 26 Jan 2007, Lisa Dusseault wrote:
> Hi Philip, thanks for the review.  But are we looking at the same version of 
> this doc?  We dealt with this after doing a pseudo-WG-last-call on the SMTP 
> mailing list and the -07 draft now has:

Dang.  I had pulled down the newer revision of 
draft-siemborski-rfc1734bis, but not the newer revision of 
draft-siemborski-rfc2554bis.  "You are lost in a twisty maze of I-Ds..."

So, my message regarding this specific draft can be quietly pushed off the 
end of the table.  My separate messages regarding the lack of ABNF for 
canceled authentications in the two drafts still appears to apply, 
however.

Philip Guenther