Subject: [secdir] Secdir review of draft-kucherawy-authres-spf-erratum-01

From: Catherine Meadows <[email-masked]>
Date: Thu, 12 Jan 2012 12:25:07 -0500

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.
The purpose of this ID is summed up in the introduction as follows:

 [RFC 5451] defined a new header field for electronic mail messages
   that presents the results of a message authentication effort in a
   machine-readable format.  That Request For Comments created a
   registry of results for a few message authentication mechanisms, one
   of which was the Sender Policy Framework [SPF].  The registry
   contains one entry that is inconsistent with the latter
   specification, which was noted in an erratum filed with the RFC
   Editor.  This memo updates the IANA registries accordingly.

The inconsistent header entry identifies the case in which an evaluation
according to RFC 4408 fails.  The result of failing such an evaluation is that
the client is explicitly not authorized to inject or relay mail using the sender's DNS
domain.  RFC 5451 gave "hardfail" as the result to be listed here, while RFC 4408 used "fail"
to mean the same thing.  The purpose of this ID is to recommend that IANA mark
"hardfail" as deprecated and amend the "fail" entry appropriately.

This ID is definitely security relevant, as use of the wrong header could
cause a failure to recognize a failed authorization.  Thus in the Security Considerations
section the authors say that "cautious implementers may wish to support both
result strings for some period of time."

One quibble: I believe that the above is good advice, but it seems a little hesitant.  Why the use
of the words "cautious" and "may"?  Why not say that "we recommend that"?  Even if failure
to recognize a failed authorization doesn't lead to any immediate security problem,
it could prevent recognition of a potential attack, or more benignly, of a possible
misconfiguration.  

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: [email-masked]

---

From: Catherine Meadows <[email-masked]>
Date: Thu, 12 Jan 2012 12:46:33 -0500

OK, sounds good!

Cathy

Catherine Meadows

On Jan 12, 2012, at 12:24 PM, Murray S. Kucherawy wrote:

> -->
> Hi Catherine, thanks for your comments.
> 
>  
> 
> The language chosen is basically acknowledgement that few if any implementations ever actually used “hardfail”.  The error was pointed out not long after RFC5451 was published and all of the implementations I know of did it properly from the beginning.  So the posture is really one of “In case anyone ever did do it the wrong way, ….”
> 
>  
> 
> Also, the word “recommended” has specific meaning under RFC2119 and it’s my understanding that use of such normative language in Security Considerations ought to be avoided.
> 
>  
> 
> Given all that, I’d be fine with saying “implementers are advised” versus “cautious implementers may wish”.  I’ll add that to the -02 version.
> 
>  
> 
> -MSK
> 
>  
> 
> From: Catherine Meadows [mailto:[email-masked]] 
> Sent: Thursday, January 12, 2012 9:25 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Cc: Catherine Meadows
> Subject: Secdir review of draft-kucherawy-authres-spf-erratum-01
> 
>  
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 12 Jan 2012 09:24:53 -0800

The language chosen is basically acknowledgement that few if any implementations ever actually used "hardfail".  The error was pointed out not long after RFC5451 was published and all of the implementations I know of did it properly from the beginning.  So the posture is really one of "In case anyone ever did do it the wrong way, ...."

Also, the word "recommended" has specific meaning under RFC2119 and it's my understanding that use of such normative language in Security Considerations ought to be avoided.

Given all that, I'd be fine with saying "implementers are advised" versus "cautious implementers may wish".  I'll add that to the -02 version.

-MSK

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: [email-masked]<mailto:[email-masked]>