Re: [kitten] Register too long SASL mechs?

[Robbie Harwood <[e-mail]>]

Simon Josefsson <simon=[e-mail]> writes:

> Simo Sorce <[e-mail]> writes:
>> On Wed, 2021-05-26 at 15:48 +0200, Simon Josefsson wrote:
>>
>>> 1) Just let IANA register these names even if they are
>>> non-compliant.
>>> 
>>> 2) Don't formally register them but mention them on the IANA page to
>>> avoid any interop problems and allowing people to find out what
>>> these are.
>>> 
>>> 3) Refuse registration since tey are non-compliant.
>>> 
>>> I prefer 2) but could live with 1) as well.  I don't think it is in
>>> the best interest of anybody that registration is refused on
>>> technicalities.  Maybe this post is sufficient to make relevant
>>> parties aware of what is happening, and IANA can continue with 1).

I also don't think that refusing registration would help anything.

>>> Pursuing standardization, or publishing a stable specification, of the
>>> mechanisms is orthogonal to registration, but would be useful.

Do you know if there's any intent to pursue standardization?  

>> Is there any risk that using those names can cause issues to an
>> implementation that conforms to RFC 4422 ?
>
> Any implementation that don't support them would reject them as
> unknown/invalid.  If it causes a vulnerability, that should be fixed
> anyway.  So, no, not really, as far as I can see.
>
> My biggest concern is that if we register them formally, we introduce an
> inconsistency with RFC 4422, and should there ever be an RFC describing
> them, that ought to extend RFC 4422 to increase permitted length and I'm
> not sure that is a good idea.

I'm not sure it has to.  As documentation of something that occurs in
the wild, I think it could note that those names are non-compliant?  It
could also introduce alternate, compliant names for them.

Now that said, I'm not aware of anything significant about 20 here, and
wouldn't oppose just raising the length limit on the basis of "we found
this in the wild and it's not an unreasonable name otherwise".

> IANA suggested that we can add a 'Note:' section to the registry where
> these mechanisms are mentioned, including that they don't conform to the
> particular format imposed by RFC 4422.

The suggestion of a note seems good.

Thanks,
--Robbie