Re: [http-auth] I-D Action: draft-ietf-httpauth-scram-auth-09.txt

[Tony Hansen <[e-mail]>]

On 11/13/15 10:49 AM, Alexey Melnikov wrote:
> On 13/11/2015 15:44, [e-mail] wrote:
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/
>>
>> There's also a htmlized version available at:
>> https://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-09
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-scram-auth-09
> I've updated the draft to address all comments from Tony and Simon.
>
> I discovered that examples were mistakenly saying "SCRAM-SHA-1", where
> they should have said "SCRAM-SHA-256". Oops.
>
> I also added a note saying that SCRAM-SHA-1 is registered, but not
> recommended. I hope this is Ok.

Thank you Alexey. It's getting much better. I agree with your direction
on not recommending SHA-1.

There is still a visible [CREF] within section 5.1:

   [[CREF1: Should some counter be added
   to make "sr" unique for each reauth?]]


Some minor grammar nits in 8 Security:

change
   ...  SCRAM
   allows to increase the iteration count over time in order to slow
   down the above attacks.  ...  An external security layer with
   strong encryption will prevent these attack.

to
   ...  SCRAM
   allows the server to increase the iteration count over time in order to slow
   down the above attacks.  ...  An external security layer with
   strong encryption will prevent these attacks.