Re: [kitten] Fwd: I-D Action: draft-hansen-scram-sha256-01.txt

[Simon Josefsson <[e-mail]>]

> >> One question I have for this: would it be worth change SCRAM 
> >> registrations to Expert Review in place of IETF review?
> >
> > Do you envision a number of future mechanisms under the SCRAM* 
> > family?  If not then I would prefer leaving it as IETF review.
> 
> I could envision a SHA3-based registration in the future, but I
> wouldn't guarantee it.
> 
> I'm personally of the opinion that registrations WITHIN a family
> should be lighter weight than registrations of mechanism families.

I think the reasoning for this was that introducing a new SASL
mechanism has no backwards compatibility issues so it causes no
problems -- however introducing a new SCRAM mechanism poses some more
complexity wrt negotiation and the GSS-API part that warrants more
thinking, hence more review requirements.

However in practice I think the SASL family concept introduces more
complexity and problems than it helps with, so I would prefer if all
SASL mechanisms were separate from each other or that the mechanisms
instead dictated their relationship rather than the framework.

/Simon