Subject: [NNTP] AUTHINFO and STARTTLS interaction

From: ken at oceana.com (Ken Murchison)
Date: Wed Sep 29 07:15:59 2004

Contrary to what I may have said previously, I don't think we *have* to 
prevent STARTTLS from being used after AUTHINFO.  As long as we specify 
in which order the layers are applied (per Section 4, req. 7 of RFC 
2222bis), I think we are free to allow STARTTLS before or after 
AUTHINFO.  I believe that this is something that was discussed in the 
past and there was support for it.  Do we want to revisit this, or just 
continue to disallow STARTTLS after AUTHINFO?  Since I'm not a security 
expert, I don't know what, if any, flags this might raise.

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: rra at stanford.edu (Russ Allbery)
Date: Wed Sep 29 12:00:35 2004

> expert, I don't know what, if any, flags this might raise.

I think it would be simpler overall to not have that restriction, since I
think we've already specified the order of application of the layers
elsewhere.  But I don't know about the security considerations either.  I
can't think of any off-hand, but that doesn't necessarily mean anything
for security issues.

Is there a TLS or SASL group where we could ask?

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: ken at oceana.com (Ken Murchison)
Date: Wed Sep 29 12:23:13 2004

> can't think of any off-hand, but that doesn't necessarily mean anything

Would removing this restriction make people happier with the language in 
the draft and possible implementation choices?  I know some people 
didn't want to have to negotiate TLS at the start of a session just 
because one of many groups might require it.  Note that there still 
isn't any way to disable TLS once negotiated (other than re-negotiating 
down to the NULL cipher).

> Is there a TLS or SASL group where we could ask?

I can ask some SASL/IMAP/POP3/SMTP people.

---

From: rra at stanford.edu (Russ Allbery)
Date: Wed Sep 29 12:28:22 2004

> down to the NULL cipher).

Honestly, I don't think it's going to make a whole lot of difference.  I
wouldn't spend a lot of time on this; I think it's more important to wrap
things up than to get this exactly right.

> I can ask some SASL/IMAP/POP3/SMTP people.

If it's a slam dunk, let's go ahead and change the wording, but if people
aren't sure, I'd tend to just stick with what we have so that we can get
something out the door.

---

From: clive at demon.net (Clive D.W. Feather)
Date: Wed Sep 29 22:56:49 2004

Ken Murchison said:
> continue to disallow STARTTLS after AUTHINFO?

I'd prefer not to have the restriction; IMO it's better for the documents
to be decoupled as far as possible.

> Since I'm not a security 

Nor I.

-- 
Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <[email-masked]>  | Fax:    +44 870 051 9937
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
Thus plc            |                            |

---

From: rra at stanford.edu (Russ Allbery)
Date: Wed Sep 29 23:03:05 2004

> I'd prefer not to have the restriction; IMO it's better for the
> documents to be decoupled as far as possible.

Ken and I have been discussing this some in e-mail with Mark Crispin, and
as a result of that discussion, I realized a few things that I'd forgotten
about this.

First, STARTTLS requires that one discard all authentication information
performed before STARTTLS happens, which means that if one authenticates
and then runs STARTTLS, one ends up unauthenticated again.  This is very
counterintuitive.

Second, if one then wants to re-establish authentication, we end up with
essentially a backdoor way to do re-authentication, something that we'd
previously decided to punt on because it was too complex to describe
properly.

I think those two problems are fatal, or at least more of a headache than
I think we want to deal with at this point.  Please let me know if you
disagree, but barring disagreement, I think we should just leave well
enough alone.

(Mark also had other concerns related to the ease of hijacking
authenticated sessions that aren't protected by a privacy layer and his
poor experience as a client author with reactive authentication in NNTP.)

---

From: clive at demon.net (Clive D.W. Feather)
Date: Wed Sep 29 23:14:19 2004

> and then runs STARTTLS, one ends up unauthenticated again.  This is very

Argh. You're right; that trumps my desire for uncoupled documents.
Leave the restriction in place.