Subject: RE: Comments on draft-ietf-sasl-rfc2831

From: "Paul Leach" <[email-masked]>
Date: Fri, 11 Apr 2003 15:40:30 -0700

> 
> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]] 
> Sent: Wednesday, April 09, 2003 12:25 PM
> To: Alexey Melnikov
> Cc: [email-masked]
> 
> 
> >>>>> "Alexey" == Alexey Melnikov <[email-masked]> writes:
> 
> 
>     Alexey> === I am not sure whether the last paragraph belongs to
>     Alexey> this document, or whether it should be moved to the SASL
>     Alexey> document or profile documents.  Personally, I would hate
>     Alexey> to update each profile document with this text.
> 
> I think that this goes in the base spec.
> 
> 
> I'll think about text for the man-in-the-middle case.  I'm 
> not really sure what we want to happen.
> 
> We could recommend that people always mandate integrity 
> protection or confidentiality, but doing so would create 
> interoperability problems.

That's not necessary, as long as both sides only offer or agree to
mechanisms that meet their minimum security requirements. I.e., it's not
great but not fatal that they don't always agree on the strongest
mechanism.

Also, using integrity protection on confidentiality does nothing to
prevent attacks on QOP, cipher, etc, negotiations.

> We could recommend that people not use digest-md5, but we 
> should have something to recommend instead.
> 
> 
>

---

From: "Paul Leach" <[email-masked]>
Date: Fri, 11 Apr 2003 15:40:30 -0700