Subject: RE: RFC 2195 (Was: what happened to newtrk?)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 8 Sep 2006 07:10:37 -0700

> From: Jeffrey Hutzelman [mailto:[email-masked]] 

> 
> On Thursday, September 07, 2006 08:12:44 PM -0700 
> "Hallam-Baker, Phillip" 
> <[email-masked]> wrote:
> 
> > The solution to this particular problem is to use SSL as 
> the transport.
> > IMAP and POP both support this use. It is a trivial matter 
> to discover 
> > that IMAPS is supported using an SRV record.
> 
> Of course, if you depend on this technique to determine 
> whether TLS should be used, you are subject to a downgrade 
> attack which not only exposes your password to a dictionary 
> attack, but also makes it fairly simple for an attacker to 
> gain access to the server as you _without_ carrying out such 
> an attack.

How so?

The attacker cannot downgrade the server security, particularly if the server does not support unencrypted IMAP or POP.

If you deploy DNSSEC the downgrade attack can be eliminated.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ned Freed <[email-masked]>
Date: Fri, 08 Sep 2006 07:27:28 -0700 (PDT)

> > > The solution to this particular problem is to use SSL as the transport.

> The attacker cannot downgrade the server security, particularly if the server
> does not support unencrypted IMAP or POP.

I don't think the lack of support for unencrypted IMAP or POP is quite
sufficient. What's to stop an attacker acting as a MITM (by
publishing a bogus SRV record or whatever) getting an unencypted connection and
turning around and connecting to the server using encryption?

Either a client key check on the server or the client requiring
encyption and checking the server cert will address this, I believe.

> If you deploy DNSSEC the downgrade attack can be eliminated.

That prevents one MITM attack vector, but there may be others.

However, just because this and other attacks are real doesn't mean that there's
no security gain from a setup that's subject to downgrade attacks. Often as not
it is far more difficult to mount a MITM attack than it is to mount to perform
passive eavesdropping.

				Ned

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 8 Sep 2006 10:51:02 -0400 (EDT)

> turning around and connecting to the server using encryption?

That's exactly the scenario I was thinking of.

> it is far more difficult to mount a MITM attack than it is to mount to perform

True.  However, spoofing a DNS response is often considerably easier than
mounting a MITM attack at the network layer.  Phill is correct that
deploying DNSSEC helps with this.  However, I don't see wide deployment of
DNSSEC today, and I'm not holding my breath.  Please, feel free to prove
my pessimism unwarranted.

-- Jeff