Re: [http-auth] [saag] AD sponsoring draft-hansen-scram-sha256

[Simon Josefsson <[e-mail]>]

Den Mon, 16 Feb 2015 21:15:40 +1100
skrev Re: [saag] AD sponsoring draft-hansen-scram-sha256:

> On 16 February 2015 at 20:48, Simon Josefsson <[e-mail]>
> wrote:
> > Since SCRAM was published, we have learned that the tls-unique
> > channel binding is insecure -- it would be nice if we could combine
> > the SHA256 update with another default channel binding type to
> > resolve that problem.  In my view, the problem with SCRAM today
> > isn't primarily its use of SHA1 but it's broken channel binding.
> 
> 
> We have a solution for that:
> https://tools.ietf.org/html/draft-ietf-tls-session-hash

Then SCRAM-SHA256 should normatively references that and require that
it is implemented for secure use of SCRAM with channel bindings.  There
are drawbacks with that approach: it is not widely implemented, not
published as an RFC that updates earlier TLS versions, and difficult
for SCRAM implementers to validate (usually the TLS stack is opaque to
the SCRAM implementer).  I could live with that though, as a way of
pushing the current security problem down from the IETF protocol layer
into the implementation layer.

Alternatively, use a new channel binding type that use the extended
master secret derivation as described by the document above.  I could
update draft-josefsson-sasl-tls-cb to describe this approach.

/Simon