Re: [kitten] The Hashed-Token SASL Mechanism (SASL-HT)

[Florian Schmaus <[e-mail]>]

On 17.10.2017 16:08, Sam Whited wrote:
> On Fri, Sep 29, 2017, at 04:08, Florian Schmaus wrote:
>> I would like to note the existence of draft-schmaus-kitten-sasl-ht-01:
>>
>> https://tools.ietf.org/html/draft-schmaus-kitten-sasl-ht-01
> 
> After a quick read through of the latest draft, the only thing I found
> which I wasn't sure about was the following:
> 
>> Before sending the authentication identity string the initiator SHOULD
>> prepare the data with the UsernameCaseMapped profile of [RFC7613].
> 
> This limits the SASL mechanisms usefulness to Unicode encodings. I'd
> suggest that normalizing the username is something the application
> protocol should do, it should not be required by the authentication
> framework (as far as SASL is concerned these should just be bytes).

I am not sure about that. SCRAM has the same requirement.

> —Sam
> 
> P.S. Also note that 7613 was recently replaced by RFC 8265, if this
> reference is kept it may be good to update it.

Thanks. Updated in 02-SNAPSHOT. I also note that
https://tools.ietf.org/html/rfc7613 does not show a sign that the RFC
has been obsoleted. Maybe someone should ping Peter. :)

- Florian