Subject: [secdir] sec-dir review of draft-ietf-sieve-autoreply-02

From: Derek Atkins <[email-masked]>
Date: Wed, 01 Dec 2010 15:56:25 -0500

Hi,

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

   This document describes how the Sieve email filtering language, along
   with some extensions, can be used to create automatic replies to
   incoming electronic mail messages based on the address book and
   presence information of the recipient.

The security considerations section details many potential issues with
automated responders.  One attack that it does not mention is the
potential for using the auto-responder as an oracle, in particular if
the system is using any public key cryptographic methods.  An attacker
could, theoretically, use the auto-responder to perform timing attacks.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Barry Leiba <[email-masked]>
Date: Wed, 1 Dec 2010 16:09:12 -0500

Hi, Derek, and thanks for the review.

> could, theoretically, use the auto-responder to perform timing attacks.

You mean, as a covert channel?

The "probing" paragraph isn't sufficient to cover that as well? (It
doesn't focus on covert channels, but does talk about probing for
presence changes.)

Barry

---

From: Derek Atkins <[email-masked]>
Date: Fri, 03 Dec 2010 08:47:34 -0500

Hi,

> doesn't focus on covert channels, but does talk about probing for

I wasn't specifically thinking about covert channels.  I was more
thinking about cases where the autoresponder could perform some
operation on behalf of an attacker and return the results.  For example,
I would be concerned if the auto-responder returned the result of a DKIM
verification, or perhaps an OpenPGP or S/MIME decryption.  I'm thinking
about this more as a cryptographic oracle, not necessarily an IMPP
oracle.

-derek

---

From: Barry Leiba <[email-masked]>
Date: Fri, 3 Dec 2010 10:39:46 -0500

Off list, Derek and I had a couple of exchanges, and Derek suggested
the following text, which I think is fine, and which I will add to my
working version of the document:

----------------------
 An autoresponder can cause leaks of other pieces of information,
 including potentially providing the ability to attack cryptographic
 keying material.  For example, using the time it takes to perform an
 cryptographic operation an attacker may obtain information about the
 secret key.  An autoresponder that doesn't take timing into account
 could accidentally leak this kind of information.

 Moreover, if an autoresponder script returns the results of a
 cryptographic operation that could also provide an attack vector.  For
 example, if a script returns the results of a decryption operation, an
 attacker can send an arbitrarily encrypted message and use the results
 as a chosen cyphertext attack to decode the encryption key.  Authors
 of scripts should be careful in what information they return to
 senders.
----------------------

Barry