外文翻译--SMTP服务扩展的认证机制.doc
外文文献原文SMTPServiceExtensionforAuthenticationThisdocumentspecifiesanInternetstandardstrackprotocolfortheInternetcommunity,andrequestsdiscussionandsuggestionsforimprovements.Pleaserefertothecurrenteditionofthe"InternetOfficialProtocolStandards"(STD1)forthestandardizationstateandstatusofthisprotocol.Distributionofthismemoisunlimited.CopyrightNoticeCopyright(C)TheInternetSociety(1999).AllRightsReserved.1.IntroductionThisdocumentdefinesanSMTPserviceextensionESMTPwherebyanSMTPclientmayindicateanauthenticationmechanismtotheserver,performanauthenticationprotocolexchange,andoptionallynegotiateasecuritylayerforsubsequentprotocolinteractions.ThisextensionisaprofileoftheSimpleAuthenticationandSecurityLayerSASL.2.ConventionsUsedinthisDocumentInexamples,"C:"and"S:"indicatelinessentbytheclientandserverrespectively.Thekeywords"MUST","MUSTNOT","SHOULD","SHOULDNOT",and"MAY"inthisdocumentaretobeinterpretedasdefinedin"KeywordsforuseinRFCstoIndicateRequirementLevels"KEYWORDS.3.TheAuthenticationserviceextension(1)thenameoftheSMTPserviceextensionis"Authentication"(2)theEHLOkeywordvalueassociatedwiththisextensionis"AUTH"(3)TheAUTHEHLOkeywordcontainsasaparameteraspaceseparatedlistofthenamesofsupportedSASLmechanisms.(4)anewSMTPverb"AUTH"isdefined(5)anoptionalparameterusingthekeyword"AUTH"isaddedtotheMAILFROMcommand,andextendsthemaximumlinelengthoftheMAILFROMcommandby500characters.(6)thisextensionisappropriateforthesubmissionprotocolSUBMIT.4.TheAUTHcommandAUTHmechanisminitial-responseArguments:astringidentifyingaSASLauthenticationmechanism.anoptionalbase64-encodedresponseRestrictions:AfteranAUTHcommandhassuccessfullycompleted,nomoreAUTHcommandsmaybeissuedinthesamesession.AfterasuccessfulAUTHcommandcompletes,aserverMUSTrejectanyfurtherAUTHcommandswitha503reply.TheAUTHcommandisnotpermittedduringamailtransaction.Discussion:TheAUTHcommandindicatesanauthenticationmechanismtotheserver.Iftheserversupportstherequestedauthenticationmechanism,itperformsanauthenticationprotocolexchangetoauthenticateandidentifytheuser.Optionally,italsonegotiatesasecuritylayerforsubsequentprotocolinteractions.Iftherequestedauthenticationmechanismisnotsupported,theserverrejectstheAUTHcommandwitha504reply.Theauthenticationprotocolexchangeconsistsofaseriesofserverchallengesandclientanswersthatarespecifictotheauthenticationmechanism.Aserverchallenge,otherwiseknownasareadyresponse,isa334replywiththetextpartcontainingaBASE64encodedstring.TheclientanswerconsistsofalinecontainingaBASE64encodedstring.Iftheclientwishestocancelanauthenticationexchange,itissuesalinewithasingle"*".Iftheserverreceivessuchananswer,itMUSTrejecttheAUTHcommandbysendinga501reply.Theoptionalinitial-responseargumenttotheAUTHcommandisusedtosavearoundtripwhenusingauthenticationmechanismsthataredefinedtosendnodataintheinitialchallenge.Whentheinitial-responseargumentisusedwithsuchamechanism,theinitialemptychallengeisnotsenttotheclientandtheserverusesthedataintheinitial-responseargumentasifitweresentinresponsetotheemptychallenge.Unlikeazero-lengthclientanswertoa334reply,azero-lengthinitialresponseissentasasingleequalssign("=").Iftheclientusesaninitial-responseargumenttotheAUTHcommandwithamechanismthatsendsdataintheinitialchallenge,theserverrejectstheAUTHcommandwitha535reply.IftheservercannotBASE64decodetheargument,itrejectstheAUTHcommandwitha501reply.Iftheserverrejectstheauthenticationdata,itSHOULDrejecttheAUTHcommandwitha535replyunlessamorespecificerrorcode,suchasonelistedinsection6,isappropriate.Shouldtheclientsuccessfullycompletetheauthenticationexchange,theSMTPserverissuesa235reply.TheservicenamespecifiedbythisprotocolsprofileofSASLis"smtp".IfasecuritylayerisnegotiatedthroughtheSASLauthenticationexchange,ittakeseffectimmediatelyfollowingtheCRLFthatconcludestheauthenticationexchangefortheclient,andtheCRLFofthesuccessreplyfortheserver.Uponasecuritylayerstakingeffect,theSMTPprotocolisresettotheinitialstate(thestateinSMTPafteraserverissuesa220servicereadygreeting).TheserverMUSTdiscardanyknowledgeobtainedfromtheclient,suchastheargumenttotheEHLOcommand,whichwasnotobtainedfromtheSASLnegotiationitself.TheclientMUSTdiscardanyknowledgeobtainedfromtheserver,suchasthelistofSMTPserviceextensions,whichwasnotobtainedfromtheSASLnegotiationitself(withtheexceptionthataclientMAYcomparethelistofadvertisedSASLmechanismsbeforeandafterauthenticationinordertodetectanactivedown-negotiationattack).TheclientSHOULDsendanEHLOcommandasthefirstcommandafterasuccessfulSASLnegotiationwhichresultsintheenablingofasecuritylayer.Theserverisnotrequiredtosupportanyparticularauthenticationmechanism,norareauthenticationmechanismsrequiredtosupportanysecuritylayers.IfanAUTHcommandfails,theclientmaytryanotherauthenticationmechanismbyissuinganotherAUTHcommand.IfanAUTHcommandfails,theserverMUSTbehavethesameasiftheclienthadnotissuedtheAUTHcommand.TheBASE64stringmayingeneralbearbitrarilylong.ClientsandserversMUSTbeabletosupportchallengesandresponsesthatareaslongasaregeneratedbytheauthenticationmechanismstheysupport,independentofanylinelengthlimitationstheclientorservermayhaveinotherpartsofitsprotocolimplementation.Examples:S:220smtp.example.comESMTPserverreadyC:EHLOjgm.example.comS:250-smtp.example.comS:250AUTHCRAM-MD5DIGEST-MD5C:AUTHFOOBARS:504Unrecognizedauthenticationtype.C:AUTHCRAM-MD5S:334PENCeUxFREJoU0NnbmhNWitOMjNGNndAZWx3b29kLmlubm9zb2Z0LmNvbT4=C:ZnJlZCA5ZTk1YWVlMDljNDBhZjJiODRhMGMyYjNiYmFlNzg2ZQ=S:235Authenticationsuccessful.5.TheAUTHparametertotheMAILFROMcommandAUTH=addr-specArguments:Anaddr-speccontainingtheidentitywhichsubmittedthemessagetothedeliverysystem,orthetwocharactersequence"<>"indicatingsuchanidentityisunknownorinsufficientlyauthenticated.TocomplywiththerestrictionsimposedonESMTPparameters,theaddr-specisencodedinsideanxtext.Thesyntaxofanxtextisdescribedinsection5ofESMTP-DSN.Discussion:TheoptionalAUTHparametertotheMAILFROMcommandallowscooperatingagentsinatrustedenvironmenttocommunicatetheauthenticationofindividualmessages.Iftheservertruststheauthenticatedidentityoftheclienttoassertthatthemessagewasoriginallysubmittedbythesuppliedaddr-spec,thentheserverSHOULDsupplythesameaddr-specinanAUTHparameterwhenrelayingthemessagetoany