Subject: [yam] #22: RFC 4409 Interop problem: SMTP submission, STARTTLS, AUTH EXTERNAL

From: "yam issue tracker" <[email-masked]>
Date: Thu, 06 May 2010 13:01:03 -0000

#22: RFC 4409 Interop problem: SMTP submission, STARTTLS, AUTH EXTERNAL
-------------------------------------+--------------------------------------
 Reporter:  sm+ietf@…                |       Owner:     
     Type:  defect                   |      Status:  new
 Priority:  major                    |   Milestone:     
Component:  pre-evaluation-template  |     Version:     
 Severity:  -                        |    Keywords:     
-------------------------------------+--------------------------------------
 Interop issue posted by Chris Newman on April 30.

 I've been dealing with client certificate authentication lately and
 realized we have an interoperability problem with our standards.  For SMTP
 submission, when an end-user wishes to authenticate using a client
 certificate, the protocol sequence to do so is unclear.

 This sequence works assuming the server enables SASL EXTERNAL and the
 client implements it (not true of all deployed software):

 ====
 C: EHLO ...
 S: ...
 C: STARTTLS
 S: 220 2.5.0 Go ahead with TLS negotiation.
 <negotiate TLS with client certificate>
 C: EHLO ...
 S: ...
 S: 250-AUTH EXTERNAL ...
 S: ...
 C: AUTH EXTERNAL =
 S: 235 2.7.0 EXTERNAL authentication successful.
 C: MAIL FROM:<[email-masked]>
 C: RCPT TO:<[email-masked]>
 <relay is allowed>
 ====

 This sequence of commands may or may not work but RFC 4409 section 4.3 can
 be interpreted to permit it assuming a client certificate via TLS counts
 as "independently established authentication":

 ====
 C: EHLO ...
 S: ...
 C: STARTTLS
 S: 220 2.5.0 Go ahead with TLS negotiation.
 <negotiate TLS with client certificate>
 C: EHLO ...
 S: ...
 C: MAIL FROM:<[email-masked]>
 C: RCPT TO:<[email-masked]>
 <relay may or may not be allowed>
 ====

 An SMTP submission client that implements only the latter will not
 interoperate with an SMTP submission server that implements only the
 former (and possibly vice versa if the client is unwilling to "just try
 it" when AUTH EXTERNAL isn't there).  One of these two cases must be
 interpreted or declared not valid by the standards to resolve the
 interoperability problem.

 Option 1: relevant to YAM -- Clarify 4409 section 4.3 to state that
 providing client authentication during TLS does not constitute
 "independently established authentication" because there is no indication
 in the TLS layer whether that authentication was deemed acceptable for
 SMTP submission authentication.  Perhaps note as an informational
 reference that "AUTH EXTERNAL" can be used to determine the validity for
 that purpose.

 Pros: Doesn't alter the way SMTP relay authentication works (probably good
 since relay authentication is typically manually configured trusted
 peers). It's a clarification of a vague sentence.  Consistent with
 IMAP+STARTTLS and POP+STARTTLS.  Cons: some SMTP submission clients and
 servers that could be interpreted as compliant are now considered
 incompliant.  This change would occur in YAM and some could argue it
 should derail 4409 moving to full standard.

 Option 2: Incompatible change to RFC 3207 (SMTP STARTTLS) when an SMTP
 client provides a client certificate the server deems valid for
 authentication purposes, the server MUST enable the SASL EXTERNAL
 mechanism (advertising it in EHLO and allowing it in AUTH).  If the client
 issues "MAIL FROM" without issuing an AUTH command in this situation, the
 server MUST behave as if an implicit "AUTH EXTERNAL =" was issued by the
 client.

 Pros: Doesn't break any clients.  Cons: Some previously complaint SMTP
 STARTTLS server implementations are declared incompliant (including the
 shipping product from my company ;-).

 Option 3: Incompatible change to RFC 3207 (SMTP STARTTLS) to declare that
 client authentication provided via STARTTLS is not considered valid
 authentication at the SMTP layer until the client issues an "AUTH
 EXTERNAL" command.

 Pros: Consistent with IMAP+STARTTLS and POP+STARTTLS.  Cons: Some
 previously compliant SMTP STARTTLS client and server implementations are
 declared incompliant.

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/yam/trac/ticket/22>
yam <http://tools.ietf.org/yam/>