Re: Serious design flaw in STARTLS documents

John,

I believe the flaw you indicate is generic to any protocol that
negotiates an integrity or security layer (the same problem arises
with negotiating GSSAPI protection using SASL).

As such, there are 2 layers of fixes needed:
- Document the problem in the SASL specification, and possibly in
  some document that generically describes "negotiating TLS"
- Describe the specific applicability of the problem in SMTP
  and how to solve it (discard EHLO information after TLS negotiation).

I agree that the second thing needs to be done to draft-hoffman-smtp-ssl
before it ships.
Probably it needs to be even more general; the sequence

MAIL FROM:<>
STARTTLS
.....
RCPT TO:<xyzzy>

is bogus, but not forbidden by the current document. It probably needs
to say that after STARTTLS negotiation, the state is as before EHLO;
all state is flushed.

                      Harald A

-- 
Harald Tveit Alvestrand, Maxware, Norway
[email protected]