Subject: Re: [lemonade] Comments on PUSH and PULL drafts

From: Rob Siemborski <[email-masked]>
Date: Mon, 1 Mar 2004 09:53:06 -0500 (EST)

On Sun, 29 Feb 2004, Marcus D. Leech wrote:

> I've had a look at these two drafts, and I find that from a security
> point of view, I'm
>   uncomfortable with the PULL concept.  It (I think unnecessarily)
> creates what I call
>   "trust inflation"--the IMAP server must trust some other party to ask
> for chunks of
>   e-mail messages to be forwarded onwards.  Making this work "right"
> requires a bunch of
>   new security technology that is likely to be a fruitful spawning
> ground for security
>   bugs.

I'm not sure I understand what you mean -- currently an IMAP server has to
"trust some other party to ask for chunks of e-mail messages to be
forwarded onwards" -- that is, the client, and even then this only applies
if the IMAP server somehow *cares* that the message gets forwarded (I
don't believe it does).

Indeed, there are new security issues to be looked at with URLAUTH -- but
there are also ones present in a "push" model -- that is, the SUBMIT
server needs to trust the IMAP server to submit messages on behalf of the
user.

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski | Andrew Systems Group * Research Systems Programmer
PGP:0x5CE32FCC | Cyert Hall 207 * [email-masked] * 412.268.7456
-----BEGIN GEEK CODE BLOCK----
Version: 3.12
GCS/IT/CM/PA d- s+: a-- C++++$ ULS++++$ P+++$ L+++ E W+ N(-) o? K- w-- O-
M-- V-- PS+ PE+ Y+ PGP+ t+@ 5+++ X- R@ tv-- b+ DI+++ D++ G e++ h+ r- y?
------END GEEK CODE BLOCK-----

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Mon, 1 Mar 2004 08:20:19 -0800 (PST)

> server needs to trust the IMAP server to submit messages on behalf of the

The security arguments that are advanced to favor PUSH over PULL all seem 
to assume that SUBMIT servers are SMTP servers with no authentication. 
Since such SUBMIT servers promiscuously trust everybody, there are no 
added security considerations in trusting an IMAP server.

Many of us are deploying SUBMIT servers which require authentication; and 
the SUBMIT authentication credentials are not necessarily the same as 
those for an IMAP server.  The PUSH model makes no attempt to acknowledge 
that such a concept exists, much less support this environment.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 2 Mar 2004 10:24:39 +0900

Marcus,

MDL> "trust inflation"--the IMAP server must trust some other party to
MDL> ask for chunks of e-mail messages to be forwarded onwards. Making
MDL> this work "right" requires a bunch of new security technology
MDL> that is likely to be a fruitful spawning ground for security
MDL> bugs.

The IMAP server produces message contents to clients that have
authenticated themselves. Like most such services, it uses a session
model. The PULL mechanism uses a transaction-based, one-time
authentication mechanism, carried with the retrieval request.  At this
level of description it does not sound as if the security exposures
are all that different.

The fact that the one-time mechanism uses an authentication string
that is, itself, generated by the IMAP service, whereas the session
model uses one that comes from unknown methods, might be interesting,
but it is difficult to see how that increases risk.

The fact that the transaction security string is passed to an IMAP
client that, in turns, passes it to the SUBMIT server which does the
PULL certainly makes the security of the two transfers significant.
However it is hard to see how this poses a serious challenge or
significantly raises risk.

The fact that the transaction security string is good for retrieving
only the associated data constrains the exposure.

It's not clear what "new security technology" is required. A similar,
third-party, security-based retrieval string scheme is exactly the
basis for Tumbleweed's business and they have had pretty good success
selling it for its security properties and, alas, for getting a patent
on the technique. No, that does not mean the technique offers valid
security or that it does not pose serious risk, but it is a nicely
concrete demonstration that the methodology is not new.

So your concern about "inflation" would be worth expanding on, please.

We should also pay attention to the history of software complexity
being a source of security exposure, too. If this is more difficult to
implement in IMAP servers -- and they are already painfully
complicated -- then it is likely that those servers will be even
easier to break into.

d/

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 2 Mar 2004 07:06:09 +0900

Marcus,

d/

d/