Re: Welcome to the ietf-apps-tls mailing list

Date: Wed, 7 May 1997 10:59:56 -0700 (PDT)
From: John Gardiner Myers <[email protected]>

> On Tue, 6 May 1997, Dennis Glatting wrote:
> > If two parties support non-TLS connections and TLS
> > connections and the TLS keyword is nuked, then a non-TLS
> > connection may be established.
>
> An implementation which accepts both TLS and non-TLS
> connections is vulnerable to this attack, regardless of the
> method used for selecting TLS.  It is not specific to STARTTLS.
>
> For example, if TLS and non-TLS connections are done on
> separate ports, a MIM attacker could cause the connection to
> the TLS port to fail with a fake ICMP Port Unreachable
> ("connection refused") error.  Then, a non-TLS connection may
> be established.
>

I whole heartily agree. I am suggesting it be included in the
Security Issues section of the draft.


-dpg