Re: Man In The Middle Attacks and STARTTLS

It's hard to enumerate all possible MITM attacks, here's a few:

* drop TCP SYN packet
* change client IP address in all TCP packets for connection
* re-route connection to different server/port by proxy/packet
  modification
* disable EHLO
* remove STARTTLS from the EHLO response
* fail the STARTTLS command with an error
* remove/adjust cipher suites in the TLS negotiation
* remove/adjust certificates in the TLS negotiation

I'm sure there are plenty that I missed.  It's possible to generate
various audit alarms if information about a particular client-server pair
is logged and that information changes.  But ultimately there is only one
way to really protect against these attacks: both ends have to be
configured to require _active_ encryption with an acceptable key length
before sending any envelope/payload information. 

		- Chris