Re: draft-hoffman-rfc2487bis-03.txt

[Bodo Moeller <moeller@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>]

On Tue, Aug 29, 2000 at 08:13:35PM +0200, Lutz Jaenicke wrote:
> On Tue, Aug 29, 2000 at 10:03:08AM +0200, Bodo Moeller wrote:
>> On Thu, Aug 24, 2000 at 05:18:35PM +0200, Lutz Jaenicke wrote:

>>> Hmm. I think I/we do need some clarification. Section 4 states:
>>>     The STARTTLS keyword is used to tell the SMTP client that the SMTP
>>>     server is currently able to negotiate the use of TLS. It takes no
>>>     parameters.
>>> Section 5 however allows
>>>     454 TLS not available due to temporary reason
>>> 
>>> So actually, section 5 implicitly allows the server to step back from its
>>> STARTTLS offer.

>> No.  This 454 is a reply that clients may see in response to STARTTLS
>> when STARTTLS was not offered in the EHLO reply.

> My understanding is that a client should not use the STARTTLS command if
> it was not offered. It may see a 5xx reply in that case.

The client *should* not use the STARTTLS command, but if it does
anyway (e.g. because it is configured to always use STARTTLS when
connecting to that host and thus the reply to the initial EHLO is not
even parsed), why not use a reply that tells the client that the
server does understand the STARTTLS command in principle, but cannot
handle it at the moment?  As this reply is not cryptographically
authenticated, it does not provide any security advantages whatsoever
(assuming that plain TCP over plain IP is used), but it may be helpful
for tracking down configuration problems.

(Also, if the server initially thinks that it can handle TLS, but
initialization fails for some reason, this 454 response may make sense;
or maybe just abort the connection.  There can always be unpredicted
problems, such as someone removing the smart card that is responsible
for private key operations, or the process running out of memory,
or a power failure, or whatever.)


-- 
Bodo Möller <moeller@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html
* TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt
* Tel. +49-6151-16-6628, Fax +49-6151-16-6036