Re: [kitten] The Hashed-Token SASL Mechanism (SASL-HT)

[Florian Schmaus <[e-mail]>]

On 17.10.2017 15:02, Simo Sorce wrote:
> On Sun, 2017-10-15 at 21:51 -0500, Benjamin Kaduk wrote:
>> On Fri, Sep 29, 2017 at 11:08:10AM +0200, Florian Schmaus wrote:
>>> I would like to note the existence of draft-schmaus-kitten-sasl-ht-
>>> 01:
>>>
>>> https://tools.ietf.org/html/draft-schmaus-kitten-sasl-ht-01
>>
>> Thanks, I just got a chance to look it over.
>>
>> [...]
>>
>>> Thus we initially authenticate an XMPP session using a strong
>>> mechanism
>>> like SCRAM, but at resumption-time we want a single round trip
>>> mechanism. The basic idea of such a mechanism is that the client
>>> requests a short-lived, exclusively ephemeral token after being
>>> authenticated, which can be used to authenticate the resumption in
>>> an
>>> efficient manner.
>>
>> [...]
>>> The SASL HT-* mechanism outlined is attempting to provide a
>>> reasonably
>>> secure authentication based around a token obtained over the
>>> application
>>> protocol, in a single round-trip. This single-round-trip is a key
>>> requirement. The proposal uses a single-use token as a shared
>>> secret,
>>> provides channel binding and mutual authentication.
>>
>> There does seem to be some value in having a fast "session
>> resumption" SASL mechanism to avoid repeated reauthentication (though
>> presumably there should be some guidance to periodically require a
>> full authentication; various flows elsewhere do this on a month
>> timescale, roughly).
>> It's a little unfortunate that this ends up requiring TLS for
>> confidentiality (as there is some desire to have standalone
>> mechanisms), but that seems to be an acceptable tradeoff for this
>> sort of application.
> 
> I think this draft has many goals in common with this one:
> https://tools.ietf.org/html/draft-wibrown-ldapssotoken-02
> 
> I wonder if we can end up having a solution that will work well to
> cover it all ?

Thanks for point this out. I'll have a look at
draft-wibrown-ldapssotoken-02 and get back to you.

- Florian