datatracker.ietf.org
Sign in
Version 5.4.0, 2014-04-22
Report a bug

Integrity, Privacy, and Security in Open Pluggable Edge Services (OPES) for SMTP
RFC 4902

Document type: RFC - Informational (May 2007)
Document stream: IETF
Last updated: 2013-03-02
Other versions: plain text, pdf, html

IETF State: (None)
Consensus: Unknown
Document shepherd: No shepherd assigned

IESG State: RFC 4902 (Informational)
Responsible AD: Ted Hardie
Send notices to: opes-chairs@tools.ietf.org

Network Working Group                                         M. Stecher
Request for Comments: 4902                              Secure Computing
Category: Informational                                         May 2007

                   Integrity, Privacy, and Security
            in Open Pluggable Edge Services (OPES) for SMTP

Status of This Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The IETF Trust (2007).

Abstract

   The Open Pluggable Edge Services (OPES) framework is application
   agnostic.  Application-specific adaptations extend that framework.
   Previous work has focused on HTTP and work for SMTP is in progress.
   These protocols differ fundamentally in the way data flows, and it
   turns out that existing OPES requirements and IAB considerations for
   OPES need to be reviewed with regards to how well they fit for SMTP
   adaptation.  This document analyzes aspects about the integrity of
   SMTP and mail message adaptation by OPES systems and about privacy
   and security issues when the OPES framework is adapted to SMTP.  It
   also lists requirements that must be considered when creating the
   "SMTP adaptation with OPES" document.

   The intent of this document is to capture this information before the
   current OPES working group shuts down.  This is to provide input for
   subsequent working groups or individual contributors that may pick up
   the OPES/SMTP work at a later date.

Stecher                      Informational                      [Page 1]
RFC 4902                   OPES/SMTP Security                   May 2007

Table of Contents

   1. Introduction ....................................................3
      1.1. Differences between Unidirectional and
           Bidirectional Application Protocols ........................3
      1.2. Non-Standardized SMTP Adaptations at SMTP Gateways .........3
      1.3. Non-OPES Issues of SMTP ....................................4
      1.4. Opportunities of OPES/SMTP to Address Some Issues ..........4
      1.5. Limitations of OPES in Regards to Fixing SMTP Issues .......4
   2. Terminology .....................................................5
   3. Integrity, Privacy, and Security Considerations .................5
      3.1. Tracing Information in OPES/SMTP ...........................5
      3.2. Bypass in OPES/SMTP ........................................6
      3.3. Compatibility with Cryptographic Protection Mechanisms .....7
   4. Protocol Requirements for OPES/SMTP .............................8
   5. IAB Considerations for OPES/SMTP ................................9
      5.1. IAB Consideration (2.1) One-Party Consent ..................9
      5.2. IAB Consideration (2.2) IP-Layer Communications ............9
      5.3. IAB Consideration (3.1) Notification .......................9
      5.4. IAB Consideration (3.2) Notification ......................10
      5.5. IAB Consideration (3.3) Non-Blocking ......................10
      5.6. IAB Consideration Application Layer Addresses (4.x) .......10
      5.7. IAB Consideration (5.1) Privacy ...........................10
      5.8. IAB Consideration Encryption ..............................11
   6. Security Considerations ........................................11
   7. References .....................................................11
      7.1. Normative References ......................................11
      7.2. Informative References ....................................11
   Appendix A. Acknowledgements ......................................13

Stecher                      Informational                      [Page 2]
RFC 4902                   OPES/SMTP Security                   May 2007

1.  Introduction

   Because OPES is a protocol that is built over application layer
   transports, its security may depend on the specifics of the
   transport.  OPES designs are guided by the IAB considerations for
   OPES document [2], and those considerations are revisited here in the
   context of the SMTP protocol.

   Section 3 of the OPES SMTP use cases document [6] maps some email and
   SMTP elements to OPES names that are used in this document.

1.1.  Differences between Unidirectional and Bidirectional Application
      Protocols

   The IAB listed considerations for Open Pluggable Edge Services (OPES)
   in [2] and OPES treatment of those considerations has been discussed
   in [3].  Both documents make use of HTTP as an example for the
   underlying protocol in OPES flows, and focus on web protocols that
   have requests and responses in the classic form (client sends a
   request to a server that replies with a response of the same protocol

[include full document text]