re: New version of TLS + IMAP/POP/ACAP draft

On Mon, 23 Nov 1998, Mark Crispin wrote:

: On Mon, 23 Nov 1998 14:25:13 -0800 (PST), Chris Newman wrote:
: > Please suggest specific replacement
: > text so we may debate the relative merits.
: 
: OK, fair enough.  My proposed changes are very simple and small.  I also
: corrected some syntax nits:
: 
: Section 6:
:      This defines the "PLAIN" SASL mechanism for use with ACAP and other
:      protocols with no clear-text login command.  The PLAIN SASL mechanism
:      MUST NOT be used unless strong TLS encryption or an equivalent strong
:      encryption layer is also in use.
: 
:      If other words, if a strong encryption layer is not currently in use
:      in the session, a server MUST NOT advertise the PLAIN SASL mechanism
:      and MUST NOT accept an attempt to authenticate via the PLAIN SASL
:      mechanism; and furthermore a client MUST NOT attempt to authenticate
:      via the PLAIN SASL mechanism.


Interesting. Mark's wording appears to me both stronger and broader at the
same time. Stronger in that it makes clear that unequivocally no PLAIN SASL
may go out unencrypted. Broader in that by dropping the "This MUST NOT be
implemented unless strong ... also implemented" it opens the door for
wrappers like a modified "stunnel" to go infront of a server with a
-plain_sasl flag. 

Is this desireable? It sure makes implementing current imaps and pop3s
servers a breeze.



: Section 9:
:      Use of clear-text login mechanisms (e.g., the IMAP4 LOGIN command,
:      POP3 PASS command or the PLAIN mechanism) without a suitable
:      encryption layer, such as that provided by TLS, expose the user's
:      password to a common network eavesdropping attack.  Therefore, the
:      PLAIN mechanism MUST NOT be used unless a suitable encryption layer,
:      such as that provided by TLS, is in use.
: 
: The significant change is a flat prohibition on the use of PLAIN outside of an
: encryption layer.
: 


Ditto.


Otherwise I thought you were both trying to say the same thing...

Randall