Re: [apps-discuss] [kitten] [saag] HTTP authentication: the next generation

[Nicolas Williams <[e-mail]>]

On Sun, Dec 12, 2010 at 09:29:39AM +0200, Yaron Sheffer wrote:
> I am not a big fan of EAP myself (although I am a co-author on
> Yoav's TLS-EAP), but no, for pragmatic reasons SASL is not the moral
> equivalent.
> 
> There is a number of EAP methods that provide zero-knowledge
> password based mutual authentication (i.e. password based auth
> that's *not* susceptible to dictionary attacks). These include (see http://www.iana.org/assignments/eap-numbers/eap-numbers.xml#eap-numbers-3):
> EAP-SRP-SHA1, EAP-pwd, EAP-EKE and EAP-SPEKE.

You missed the ABFAB thing...  ABFAB WG is producing [drumroll please] a
GSS-API mechanism that uses EAP.  And SASL can use GSS mechanisms (via
"GS2" [RFC5801]).

So, I believe that the answer is "yes".

Nico
--