Subject: Re: rfc2222bis: suggested text about multiple SASL mechanisms

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 01 Dec 2003 13:47:40 -0800

At 07:16 PM 11/14/2003, Sam Hartman wrote:
>One thing we need to keep in mind is that over time, we get a better
>idea of what best practices for using SASL are.

My operational experiences with LDAP show that making available a
list of mechanisms post authentication isn't the "best" practice
for preventing MITM downgrade attacks.

I think the "best" practice is for the client and server to have
policy which states what the levels of service are or are not
acceptable (and when).  A simple mechanism can just dictate minimum
levels and refuse when not met.  A more complex mechanism could
have two levels, minimum and recommend, where less than recommended
but higher than minimum required user authorization.

I think the list mechanism approach in LDAP is a bit problematic.
First, SASL (or other) security layers may not have been established
making the information subject to MITM attack.  Second, LDAP allows
the list of mechanisms to change based upon current availability
(to this client).  It is possible that a stronger mechanism is,
for legitimate reasons, no longer available.  It is not possible
for the client to deduce why a change in the listing was made.  A
more workable approach would be to recommend the server provide
a list of mechanisms which WERE available to the client when it
authenticated to the server.  Lastly, the list doesn't prevent
any similar MITM attacks (for example, downgrading of the
cipher suites used by a listed mechanism).

I also note that I have yet to find a client which actually uses
the list of available mechanisms to detect MITM attacks.  Clients
which do attempt to detect such attacks tend to use a policy based
mechanism.

In short, I don't think we have enough good operational experience
to add these imperatives to the technical specification.

Kurt

---

From: Sam Hartman <[email-masked]>
Date: Mon, 01 Dec 2003 17:06:44 -0500

>>>>> "Kurt" == Kurt D Zeilenga <[email-masked]> writes:

    Kurt> At 07:16 PM 11/14/2003, Sam Hartman wrote:
    >> One thing we need to keep in mind is that over time, we get a
    >> better idea of what best practices for using SASL are.

    Kurt> My operational experiences with LDAP show that making
    Kurt> available a list of mechanisms post authentication isn't the
    Kurt> "best" practice for preventing MITM downgrade attacks.

    Kurt> I think the "best" practice is for the client and server to
    Kurt> have policy which states what the levels of service are or
    Kurt> are not acceptable (and when).  A simple mechanism can just
    Kurt> dictate minimum levels and refuse when not met.  A more
    Kurt> complex mechanism could have two levels, minimum and
    Kurt> recommend, where less than recommended but higher than
    Kurt> minimum required user authorization.

We all agree this is sufficient.

However I believe that IETF experience with other security protocols
strongly favors having a way to detect downgrades when possible.

The problem is that in practice, people tend to establish fairly loose
policies on their clients, so in situations where it is possible to
detect the downgrade it is a good idea to do so.

I agree there is not significant experience with this in the SASL
community, but I believe there is sufficient experience in the SASL
community to say that client policies do tend to be fairly lax and
experience in the rest of the IETF to say that downgrade detection is
desirable.

I believe that is sufficient to provide advice for new protocols.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 01 Dec 2003 13:47:40 -0800

Kurt

---

From: Sam Hartman <[email-masked]>
Date: Mon, 01 Dec 2003 17:06:44 -0500