Subject: [secdir] secdir review of draft-elie-nntp-tls-recommendations-01

From: David Mandelberg <[email-masked]>
Date: Sun, 4 Dec 2016 13:21:59 -0500

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

I think this document is ready with nits.

Section 2.4: I think the second to last bullet (about lack of STARTTLS)
should be expanded in scope to say "during any previous connection
within a (possibly configurable) time frame" instead of "during the
previous connection." Otherwise, a human might not see the warning the
first time, and the warning would disappear immediately after that.

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/

---

From: Julien ÉLIE <[email-masked]>
Date: Thu, 8 Dec 2016 22:47:34 +0100

Hi David,

> I think this document is ready with nits.

Many thanks for having taken the time to review the document.

> first time, and the warning would disappear immediately after that.

Oh, you're totally right.  That's a pretty good catch.
I've adopted your wording in the future revised I-D.

Incidentally, I would like to point out that I received in the 
(concluded) IETF NNTP a suggestion of answer for the 3rd question in 
Appendix E:
   https://lists.eyrie.org/pipermail/ietf-nntp/2016-November/006249.html
   https://lists.eyrie.org/pipermail/ietf-nntp/2016-December/006251.html

FYI, the use of ports 119 and 433 is described in Sections 3.4.1 and 
3.4.2 of RFC 3977:

     The official TCP port for the NNTP service is 119.  However, if a
     host wishes to offer separate servers for transit and reading
     clients, port 433 SHOULD be used for the transit server and 119 for
     the reading server.

I believe it is OK to take the following text into account for the ports 
to use for NNTP over TLS, but I prefer to share with you the wording in 
case you have any comments about it.  (Maybe it is not clear enough!)
We would then have in Appendix A of the document:

  The third and fourth paragraphs in Section 1 of [RFC4642] are
  replaced with the following text:

   TCP port 563 is dedicated to NNTP over TLS, and registered in the
   IANA Service Name and Transport Protocol Port Number Registry for
   that usage.  NNTP implementations using TCP port 563 begin the TLS
   negotiation immediately upon connection and then continue with the
   initial steps of an NNTP session.  This use of strict TLS on a
   separate port is the preferred way of using TLS with NNTP.

   If a host wishes to offer separate servers for transit and reading
   clients, TCP port 563 SHOULD be used for the reading server using
   strict TLS.  If a transit server offers strict TLS, it SHOULD use TCP
   port 433 if it does not accept unencrypted connections, but can
   alternatively use another unused port of its choice.  If it accepts
   dynamic upgrade from unencrypted to TLS-protected traffic, it SHOULD
   use TCP port 433 for that usage, and another unused port of its
   choice for strict TLS.  In either case, the port used for strict TLS
   should be clearly communicated to the client, and specifically that
   no plain-text communication occurs before the TLS session is
   negotiated.

-- 
Julien ÉLIE

« – Et si vous ne trouvez pas, je vous fais bouillir et servir aux
     lions avec de la sauce à la menthe !!!
   – Mais c'est horrible ça !
   – Oui, pauvres bêtes ! » (Astérix)

---

From: David Mandelberg <[email-masked]>
Date: Thu, 08 Dec 2016 17:09:25 -0500

On 2016-12-08 16:47, Julien ÉLIE wrote:
> I believe it is OK to take the following text into account for the
> ports to use for NNTP over TLS, but I prefer to share with you the
> wording in case you have any comments about it.  (Maybe it is not
> clear enough!)

 From a security point of view, I have no objection to this text.

I'm a bit surprised that you're using the same port (433) for both plain 
TLS and for STARTTLS, but as long as clients and servers are configured 
correctly, that should work. I assume there's no protocol switching 
attack between TLS and NNTP?

---

From: Julien ÉLIE <[email-masked]>
Date: Fri, 9 Dec 2016 23:20:01 +0100

Hi David,

> From a security point of view, I have no objection to this text.

... unless if it can lead to "protocol switching attack between TLS and 

> attack between TLS and NNTP?

Well, you're right there's something weird here.
In fact, I was suggesting to use port 433 for strict TLS when the 
transit server only allows encrypted connections.  If some clients use 
unencrypted connections and some other clients use TLS-protected 
connections, then port 433 was to be used for unencrypted connections as 
well as connections using dynamic upgrade from unencrypted to 
TLS-protected traffic; and another port of its choice for strict TLS.
I agree it finally looks weird and inconsistent.

The rationale behind was:
- the common case is both reading&transit via port 119 (unencrypted, 
with possible use of STARTTLS), and strict TLS for reading via port 563;
- servers handling reading&transit on the same port can of course use 
strict TLS for transit via port 563;
- a few servers offer transit via port 433 (unencrypted, with possible 
use of STARTTLS), and keep ports 119/563 for reading.

Note that there is no IANA registered port for transit-only exchanges 
over TLS.  IANA registered ports are 119 (NNTP), 433 (NNSP) and 563 
(NNTP/TLS).

So I believe we have two alternatives right now:
a/ asking IANA to register a new port for NNSP/TLS and then explicitly 
say to use that port for transit with strict TLS;
b/ explicitly say to use another port than 433 for transit with strict TLS.

Alternative a/ is cleanest but maybe that new port will never be used in 
practice...
That's why I suggest b/ but of course I would be OK if a/ is chosen.
** Alexey, do you have any opinion about that?

Considering b/ (that I will adopt unless decided otherwise), the text 
becomes:

    If a host wishes to offer separate servers for transit and reading
    clients, TCP port 563 SHOULD be used for strict TLS with the reading
    server, and an unused port of its choice different than TCP port 433
    SHOULD be used for strict TLS with the transit server.  The ports
    used for strict TLS should be clearly communicated to the clients,
    and specifically that no plain-text communication occurs before the
    TLS session is negotiated.

I hope that's better in a security point of view (we do not rely on the 
quality of the configuration, and there cannot be any protocol switching 
attacks).

-- 
Julien ÉLIE

« – Poussez pas derrière !
   – Pas si vite devant ! » (Astérix)