Subject: [secdir] SECDIR review of draft-kucherawy-authres-vbr

From: David McGrew <[email-masked]>
Date: Thu, 6 Jan 2011 07:58:18 -0800

I have reviewed this document as part of the security directorate's  
ongoing effort to review all IETF documents being processed by the  
IESG.  These comments were written primarily for the benefit of the  
security area directors.  Document editors and WG chairs should treat  
these comments just like any other last call comments.

This draft defines a way that a border mail gateway that assesses  
inbound email using VBR can use AUTHRES to pass along the results of  
its assessment to user agents or other entities such as mail filters.   
This is a sensible and useful thing to do, and the draft is  
straightforward and clear.  I have a few comments/questions.

Section 1.  It is not clear what problem is referred to in paragraph  
two.

Section 4.

What behavior should a mail filter have upon receiving the result  
codes defined in that section?   If the recommended behavior is  
defined elsewhere (presumably [VBR]), then it should be referenced in  
this section.

What behavior should a border mail gateway have upon receiving a VBR  
response?   For instance, under what conditions (if any) should a  
border mail gateway not forward an email on which VBR has returned  
"fail"?   I would guess that this draft expects gateways to always  
forward emails, and regards a mail filter as a logically separate  
entity.  I suggest clarifying this point.

Section 6.  The Security Considerations are short, but I agree with  
what they say (that the Security Considerations of [VBR] and [AUTHRES]  
should be read and understood).

regards,

David

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 6 Jan 2011 10:36:37 -0800

Hi David.  Thanks for your comments.

> -----Original Message-----
> From: David McGrew [mailto:[email-masked]]
> Sent: Thursday, January 06, 2011 7:58 AM
> To: [email-masked]; [email-masked]; The IESG
> Subject: SECDIR review of draft-kucherawy-authres-vbr
> 
> [...]
> 

The "problem" (though I agree it could be worded better) is that VBR came along after Authentication-Results was published, and so there's currently no standard way to convey VBR results in past a border gateway.

> defined elsewhere (presumably [VBR]), then it should be referenced in

Reactions to the information provided within an Authentication-Results field is entirely up to the consumer(s) of that information.  It's all a matter of local policy, and thus not specified in either document.  RFC5451 and its extensions only define the mechanism for transmitting that information inbound past border gateways.

> entity.  I suggest clarifying this point.

Again, it's a matter of local policy.  A gateway detecting a VBR, DKIM, SPF or any other failure is at liberty to reject or quarantine the message, or allow it to pass after adding those results via the mechanism of RFC5451 so that internal filters or MUAs can take whatever action they deem necessary without repeating those mechanisms themselves.

Since this is just an extension to the existing mechanism, I'm not sure it's useful to discuss it in this memo.  It would be better discussed in an RFC5451bis since it applies to the mechanism itself and not this extension.  That said, I'll add mention of this in an -03 draft if that's the preference.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 6 Jan 2011 10:42:12 -0800

How about this replacing the second paragraph of Section 1:

   This memo thus registers an additional reporting property allowing a
   VBR result to be relayed as an annotation in a message header.

And at the end of Section 3, covering your Section 4 issues:

   Reactions to the information contained in an Authentication-Results
   header field that contains VBR (or any) results are not specified
   here as they are entirely a matter of local policy at the receiver.

-MSK

---

From: David McGrew <[email-masked]>
Date: Fri, 7 Jan 2011 07:21:49 -0800

Hi Murray,

On Jan 6, 2011, at 10:36 AM, Murray S. Kucherawy wrote:

> The "problem" (though I agree it could be worded better) is that VBR  
> came along after Authentication-Results was published, and so  
> there's currently no standard way to convey VBR results in past a  
> border gateway.
>
>> Section 4.
>>
> Reactions to the information provided within an Authentication- 
> Results field is entirely up to the consumer(s) of that  
> information.  It's all a matter of local policy, and thus not  
> specified in either document.  RFC5451 and its extensions only  
> define the mechanism for transmitting that information inbound past  
> border gateways.
>
> Again, it's a matter of local policy.  A gateway detecting a VBR,  
> DKIM, SPF or any other failure is at liberty to reject or quarantine  
> the message, or allow it to pass after adding those results via the  
> mechanism of RFC5451 so that internal filters or MUAs can take  
> whatever action they deem necessary without repeating those  
> mechanisms themselves.
>
> Since this is just an extension to the existing mechanism, I'm not  
> sure it's useful to discuss it in this memo.  It would be better  
> discussed in an RFC5451bis since it applies to the mechanism itself  
> and not this extension.  That said, I'll add mention of this in an  
> -03 draft if that's the preference.

I'm surprised that it's not discussed in RFC5451, but given that fact  
I certainly agree that RFC5451bis would be the right place for it.

David

---

From: David McGrew <[email-masked]>
Date: Fri, 7 Jan 2011 07:22:03 -0800

Hi Murray,

Looks good to me.

David