headers
Frank Ellermann | 3 Dec 2006 23:30
Picon
Picon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Alexey Melnikov wrote:

> I would like to solicit some reviews of the 2554bis draft.

===
Use CRAM-MD5 as minimum, it's common practice if there's
anything at all between "LOGIN" and TLS PLAIN.  See also
http://en.wikipedia.org/wiki/CRAM-MD5 and
http://www.ietf.org/IESG/Implementations/CRAM-MD5_implem.txt

===
DIGEST-MD5 is far too complex for its minimal security
advantage.  As for the POP3 draft, if you like to talk
about DIGEST-MD5 please add _working_ examples in all
its confusing ugliness with up to ten (or was it eleven)
parameters in numerous valid and invalid constellations.

If you insist on DIGEST-MD5 as required add it to the
AUTH in your examples (same issue as in the POP draft).
If you use CRAM-MD5 as required add this to the AUTHs.

===
2554 says that the auth param is an <addr-spec>, but you
changed it to <mailbox>.  Please stick to <addr-spec>,
it's a huge difference.

===
What is the password in 2554 for fred, and what is it
in your draft for rjs3 ?  If I didn't screw up for fred
(Continue reading)

Permalink | Reply | 12 comments |
headers
Alexey Melnikov | 4 Dec 2006 16:34
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Hi Frank,
Thanks for you comments.

(I've skipped the DIGEST-MD5 related comments in this reply.)

Frank Ellermann wrote:

>2554 says that the auth param is an <addr-spec>, but you
>changed it to <mailbox>.  Please stick to <addr-spec>,
>it's a huge difference.
>
RFC 2822 <addr-spec> allows for CFWS around different separating 
characters and other horrible things.
I consider this to be a bug and I don't believe people have actually 
used this syntax for the AUTH parameter.

 [...]

>===
>There's no normative or otherwise reference to RFC 2195
>or 2195bis.
>
Added.

>I miss a discussion of ESMTPA etc., and a
>corresponding normative reference (RFC 3848).
>
I like the idea, but I need to think about the exact text and the best 
place to insert it.
(Continue reading)

Permalink | Reply | 10 comments |
headers
Frank Ellermann | 4 Dec 2006 19:48
Picon
Picon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Alexey Melnikov wrote:

> RFC 2822 <addr-spec> allows for CFWS around different separating
> characters and other horrible things.

Ugh...  yes, you don't want this, I confused it, sorry.  We want
the same thing, but the <mailbox> also isn't it, RFC 2882 says:

| mailbox         =       name-addr / addr-spec

I guess you have to roll your own if you want to avoid CFWS and
the 2822 obs-cenities, how about this:

+ mailbox         =       id-left " <at> " id-right

You know the details like NO-WS-CTL from "elsewhere"... <eg>

> I don't believe people have actually used this syntax for the
> AUTH parameter.

ACK, same here.  For 2368 Paul confirmed it on the URI list, or
maybe it was EAI, that <mailbox> isn't what he wanted.

>> I miss a discussion of ESMTPA etc., and a corresponding 
>> normative reference (RFC 3848).

> I like the idea, but I need to think about the exact text and
> the best place to insert it.
(Continue reading)

Permalink | Reply | 9 comments |
headers
Alexey Melnikov | 4 Dec 2006 20:09
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Frank Ellermann wrote:

>Alexey Melnikov wrote:
>  
>
>>RFC 2822 <addr-spec> allows for CFWS around different separating
>>characters and other horrible things.
>>    
>>
>Ugh...  yes, you don't want this, I confused it, sorry.  We want
>the same thing, but the <mailbox> also isn't it, RFC 2882 says:
>
>| mailbox         =       name-addr / addr-spec
>
>I guess you have to roll your own if you want to avoid CFWS and
>the 2822 obs-cenities, how about this:
>
>+ mailbox         =       id-left " <at> " id-right
>
>You know the details like NO-WS-CTL from "elsewhere"... <eg>
>  
>
The draft is referencing <mailbox> from RFC 2821, not from RFC 2822!

>>I don't believe people have actually used this syntax for the
>>AUTH parameter.
>>    
>>
>ACK, same here.  For 2368 Paul confirmed it on the URI list, or
(Continue reading)

Permalink | Reply | 8 comments |
headers
Frank Ellermann | 4 Dec 2006 23:06
Picon
Picon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Alexey Melnikov wrote:

> The draft is referencing <mailbox> from RFC 2821, not from 
> RFC 2822!

That will do the trick.  It's a <Mailbox> there, checking, yes,
rule names are case insensitive.  In 2368 it's a 2822-<mailbox>.

>> Maybe copy what you need from the Wikipedia article.

> Are you talking about CRAM-MD5/DIGEST-MD5 or ESMTPA? I was
> talking about the latter here.

Me too.  I've never seen anything ESMTPA that's not CRAM-MD5
so far, but I also didn't try hard to find it.

> I don't think CRAM-MD5 is a starter due to security concerns.

The only security difference I'm aware of is the <cnonce> if
DIGEST-MD5 is used for authentication.  If you know some
interoperable DIGEST-MD5 combo of MSA and MUA maybe submit
to the interop list, fresh ammo for the last call flamewar.

If you need a working DIGEST-MD5 example you can grab it from
NNTPAUTH (test:test).  What's the example password for rjs3 ?
I'm collecting most working MD5 examples published in RFCs :-)

Frank
(Continue reading)

Permalink | Reply | 7 comments |
headers
Tony Finch | 4 Dec 2006 23:16
Picon
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


On Mon, 4 Dec 2006, Frank Ellermann wrote:
>
> Me too.  I've never seen anything ESMTPA that's not CRAM-MD5
> so far, but I also didn't try hard to find it.

We use esmtpa for EXTERNAL authentication within our mail cluster :-)
(This message should have an example in its Received: lines.)

Tony.
--

-- 
f.a.n.finch  <dot <at> dotat.at>  http://dotat.at/
FAEROES SOUTHEAST ICELAND: NORTHEAST 6 TO GALE 8. ROUGH OR VERY ROUGH. SQUALLY
SHOWERS. GOOD.
Permalink | Reply | 6 comments |
headers
Dave Crocker | 5 Dec 2006 00:27

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Tony Finch wrote:
> We use esmtpa for EXTERNAL authentication within our mail cluster :-)
> (This message should have an example in its Received: lines.)

Tony,

I cannot figure out how to parse the concept of something that is simultaneously 
"external" and "within", so I'm entirely missing what application you are 
referencing here.

Please clarify.

Thanks.

d/
--

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
Permalink | Reply | 5 comments |
headers
Tony Finch | 5 Dec 2006 00:45
Picon
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


On Mon, 4 Dec 2006, Dave Crocker wrote:
>
> I cannot figure out how to parse the concept of something that is
> simultaneously "external" and "within", so I'm entirely missing what
> application you are referencing here.

The SASL EXTERNAL method means that the client has been authenticated by
some means external to SASL (e.g. TLS, or in my case IP addresses and
knowledge of the network topology) and that the client wants the server to
make its access control decision using this information with the
authorization identity that the client provides via SASL.

That is, EXTERNAL refers just to SASL, and not to the system as a whole.

Tony.
--

-- 
f.a.n.finch  <dot <at> dotat.at>  http://dotat.at/
HEBRIDES: SOUTHWESTERLY BECOMING CYCLONIC 4 OR 5, BUT NORTHEASTERLY 6 TO GALE
8 IN FAR NORTHWEST. ROUGH OR VERY ROUGH. RAIN OR SQUALLY SHOWERS. MODERATE OR
GOOD.
Permalink | Reply | 4 comments |
headers
Dave Crocker | 5 Dec 2006 00:54
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Tony Finch wrote:
> On Mon, 4 Dec 2006, Dave Crocker wrote:
>> I cannot figure out how to parse the concept of something that is
>> simultaneously "external" and "within", so I'm entirely missing what
>> application you are referencing here.
> 
> The SASL EXTERNAL method means that the client has been authenticated by
> some means external to SASL (e.g. TLS, or in my case IP addresses and
> knowledge of the network topology) and that the client wants the server to
> make its access control decision using this information with the
> authorization identity that the client provides via SASL.
> 
> That is, EXTERNAL refers just to SASL, and not to the system as a whole.

Ahh. Thanks.
I did, indeed, miss that 'external' was in all caps.

I'll blame my denseness on that...  Any excuse that works.

Thanks.

d/
--

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
(Continue reading)

Permalink | Reply | 0 comments |
headers
Alexey Melnikov | 5 Dec 2006 00:40
Favicon

Re: Requesting reviews: SMTP AUTH update, draft-siemborski-rfc2554bis-05.txt


Frank Ellermann wrote:

>I miss a discussion of ESMTPA etc., and a
>corresponding normative reference (RFC 3848).
>  
>
I've added the normative reference and made it a SHOULD requirement.
Permalink | Reply | 0 comments |

Gmane