Subject: SASL profile for NNTP

From: Ken Murchison <[email-masked]>
Date: Mon, 23 May 2005 15:09:40 -0400

I am a co-author of the I-D specifying the SASL profile for NNTP, which 
I have kept up to date with the current protocol profile guidelines 
specified in RFC 2222bis.  I was asked by the NNTPEXT Chair to get some 
feedback on the importance of two of the normative references in that 
draft.  I am currently referencing RFC 2222bis and RFC 2831bis (as a 
mandatory to implement mechanism), but neither of these is currently in 
last call, and the chair doesn't want to block the NNTP SASL profile 
(and the NNTP update draft as a result), if we don't have to.

AFAICT, the two major changes in these docs which might be worth 
blocking on are the discussion of SASLprep in RFC 2222bis and the 
deprecation of 3DES in RFC 2831bis.

So my question to the group is, do people feel that there are technical 
reasons why we *should* block on these updated SASL docs, or can we just 
use the existing RFCs as normative references?

As a member of both WG, I'd like to wait for these updates (provided 
they get to Last Call soon), but I'll go with whatever the consensus is 
here.

Thanks,
Ken
-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 24 May 2005 12:56:16 -0700

At 12:09 PM 5/23/2005, Ken Murchison wrote:
>I am a co-author of the I-D specifying the SASL profile for NNTP, which I have kept up to date with the current protocol profile guidelines specified in RFC 2222bis.  I was asked by the NNTPEXT Chair to get some feedback on the importance of two of the normative references in that draft.  I am currently referencing RFC 2222bis and RFC 2831bis (as a mandatory to implement mechanism), but neither of these is currently in last call, and the chair doesn't want to block the NNTP SASL profile (and the NNTP update draft as a result), if we don't have to.

Well, one question worth asking is whether NNTP'ers want to
revise again to achieve Draft Standard status.  If NNTP docs
references 2222 & 2831, then some subsequent revision
becomes necessary for these NNTP docs to reach Draft
Standard status.  And, those docs would also have to deal
with any differences between 2222 & 2222bis and between
2831 & 2831bis in that revision that might ripple into
NNTP and its implementations.

>AFAICT, the two major changes in these docs which might be worth blocking on are the discussion of SASLprep in RFC 2222bis and the deprecation of 3DES in RFC 2831bis.

I note that SASLprep is also quite relevant to RFC 2831bis.

>So my question to the group is, do people feel that there are technical reasons why we *should* block on these updated SASL docs, or can we just use the existing RFCs as normative references?

Yes.  Technical reasons include internationalization and security
considerations.

>As a member of both WG, I'd like to wait for these updates (provided they get to Last Call soon), but I'll go with whatever the consensus is here.
>
>Thanks,
>Ken
>--

---

From: Russ Allbery <[email-masked]>
Date: Tue, 24 May 2005 13:37:36 -0700

Kurt D Zeilenga <[email-masked]> writes:

> Well, one question worth asking is whether NNTP'ers want to revise again
> to achieve Draft Standard status.

This will almost certainly be necessary regardless, since the current
internationalization mess in Usenet is probably going to need to be
clarified in other documents and then referenced in NNTP before Draft
Standard status.

> I note that SASLprep is also quite relevant to RFC 2831bis.

We do already reference SASLprep and require it, independent of what the
referenced SASL document requires.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 24 May 2005 22:16:45 +0100

>I am a co-author of the I-D specifying the SASL profile for NNTP, which I have kept up to date with the current protocol profile guidelines specified in RFC 2222bis.  I was asked by the NNTPEXT Chai…
If NNTP depends on RFC 2831, does it recommend to use confidentiality 
protection?
DES/3DES in RFC 2831 is broken. NNTP can't recommend AES, as there is no 
RFC describing it. RC4 is the only thing left. Now, saying in an NNTP 
document that implementations should implement RFC 2831 but shouldn't 
use a particular cipher would be awkward at best.

---

From: Ken Murchison <[email-masked]>
Date: Wed, 25 May 2005 16:35:02 -0400

Alexey Melnikov wrote:

>> I am a co-author of the I-D specifying the SASL profile for NNTP, 
>> which I have kept up to date with the current protocol profile 
>> guidelines specified in RFC 2222bis.  I was asked by the NNTPEXT Chair 
>> to get some feedback on the importance of two of the normative 
>> references in that draft.  I am currently referencing RFC 2222bis and 
>> RFC 2831bis (as a mandatory to implement mechanism), but neither of 
>> these is currently in last call, and the chair doesn't want to block 
>> the NNTP SASL profile (and the NNTP update draft as a result), if we 
>> don't have to.
>>

Yes.  Given the fact that DIGEST-MD5 is currently in a state of flux, do 
you think that we should make CRAM-MD5 the mandatory to implement SASL 
mech?  Alternatively, we could simply mandate TLS+PLAIN.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 25 May 2005 14:03:42 -0700

At 01:35 PM 5/25/2005, Ken Murchison wrote:
>Yes.  Given the fact that DIGEST-MD5 is currently in a state of flux, do you think that we should make CRAM-MD5 the mandatory to implement SASL mech? 

Personally, I do not think CRAM-MD5 provides adequate security
for NNTP, as NNTP session would be subject to hijacking
due to CRAM-MD5 failure to provide any data security layer.

> Alternatively, we could simply mandate TLS+PLAIN. 

That might be the best choice in balancing both security
and interoperability.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 24 May 2005 12:56:16 -0700

---

From: Russ Allbery <[email-masked]>
Date: Tue, 24 May 2005 13:37:36 -0700

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 24 May 2005 22:16:45 +0100

---

From: Ken Murchison <[email-masked]>
Date: Wed, 25 May 2005 16:35:02 -0400

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 25 May 2005 14:03:42 -0700

Kurt