IETF Logo Mail Archive

Re: [kitten] [IANA #748877] please review SASL-SCRAM-256

Dave Cridland <dave@cridland.net> Fri, 11 April 2014 11:04 UTC

Return-Path: <dave@cridland.net>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C85771A01DB for <kitten@ietfa.amsl.com>; Fri, 11 Apr 2014 04:04:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.378
X-Spam-Level:
X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RnkHX3Cn4-88 for <kitten@ietfa.amsl.com>; Fri, 11 Apr 2014 04:04:33 -0700 (PDT)
Received: from mail-oa0-x235.google.com (mail-oa0-x235.google.com [IPv6:2607:f8b0:4003:c02::235]) by ietfa.amsl.com (Postfix) with ESMTP id C2CFF1A01E4 for <kitten@ietf.org>; Fri, 11 Apr 2014 04:04:33 -0700 (PDT)
Received: by mail-oa0-f53.google.com with SMTP id j17so5916723oag.40 for <kitten@ietf.org>; Fri, 11 Apr 2014 04:04:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cridland.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=4RTwxdUWbEFEXMmyWHwGW986m34596iR6gdCDJlK/tk=; b=DRRzPDj2cXyGgQdmp6ChJQq71rYwcMeTA3LqzgeUUnc1+VEJkh6a4j/aQ1Z8OBmTuF 4o/g+l8BP1behLTiKFzyQ7Iy3bPVNZrZkQCNqcWa22xGhC0+wZmfQsKZZH6D0tXMrgtp sVnuxReGUIqLnhWP5AEDWHLMbs0ryXcgLYcFg=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=4RTwxdUWbEFEXMmyWHwGW986m34596iR6gdCDJlK/tk=; b=S560SFlt6IL99YlwHR8FEiCCdkZwhv+dkZeg/rAgFJ2c/nAnhdrB6PzwZvVOemVnio Y3QjfrwctZg5/M3FC2xtDDfJgBPvdP4bK/k0nobOvoSKTqdTfdgc53V0ClxVLfdN3ZAK 9bqe0yWM188tL6g37UQrsDooccQi1gYxdv0CtXn+MnP9TYS7cgmk7pkHONH8xKlqHF5m OXjWDIoH6qHar88vy+VCusPRqv9uXa/vcJJVMKInXFBoTk46N+8WUpzZdET6Gl7ffxP6 Cw3rRuXPzv1bXcF3FXqfojF/YdLmgHB5uU/FlXFkjIq1xS0QxfxETxvUG3XpIoR/XNCk t59Q==
X-Gm-Message-State: ALoCoQlRXbZcPoxv4d/PjMNNJbj8EsbO4qOr9IzVFLLKcf5hN0ezJ7WEw1uuc0+ZddI381ws21MY
MIME-Version: 1.0
X-Received: by 10.60.157.202 with SMTP id wo10mr7028452oeb.9.1397214272458; Fri, 11 Apr 2014 04:04:32 -0700 (PDT)
Received: by 10.60.93.6 with HTTP; Fri, 11 Apr 2014 04:04:32 -0700 (PDT)
Received: by 10.60.93.6 with HTTP; Fri, 11 Apr 2014 04:04:32 -0700 (PDT)
In-Reply-To: <53475A88.3060202@att.com>
References: <RT-Ticket-748877@icann.org> <5319DE8B.1030202@att.com> <rt-4.0.8-12541-1394569374-953.748877-9-0@icann.org> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com> <53475A88.3060202@att.com>
Date: Fri, 11 Apr 2014 12:04:32 +0100
Message-ID: <CAKHUCzzfdXYLh_6-0osL6ZfVTRybdjVOd4xke24ShcYMb3PtHg@mail.gmail.com>
From: Dave Cridland <dave@cridland.net>
To: Tony Hansen <tony@att.com>
Content-Type: multipart/alternative; boundary="047d7bd6c5e862a22e04f6c24cc9"
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/5MUBfzA7Fn9jxDmeDh2EgxAJISc
Cc: kitten@ietf.org
Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Apr 2014 11:04:37 -0000

On 11 Apr 2014 03:59, "Tony Hansen" <tony@att.com> wrote:
>
> On 4/10/14, 7:10 PM, Dave Cridland wrote:
>>
>> On 10 April 2014 23:17, Simon Josefsson <simon@josefsson.org> wrote:
>>>
>>> I haven't seen anyone disagree with my interpretation that the
>>> registration policy for new SCRAM-* mechanisms are "IETF Review", which
>>> requires an RFC.  Therefor, I will suggest to IANA that they turn down
>>> the registration request until that has been fulfilled.
>>
>>
>>
>> Yes, they're IETF Review.
>>
>> Although RFC 5802 is generally hash agnostic, a handful of parts of
SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimum
iteration count for example, so an RFC might prove useful anyway.
>
>
> OK, I figured it was worth trying to do it this way. I'll start the RFC
process.
>
> Dave, a question for you: What do you think a better minimum iteration
count should be for SCRAM-SHA-256? Why should it be any different than the
value specified for SCRAM-SHA-1 (4096)?
>

No idea. I just noted that the iteration count was specific to the hash
algorithm.

> One of the items in 5802 that is out of date is the email address to send
registrations to, as it specifies sasl@ietf.org which no longer exists. So
I think an update to that part of 5802 is needed to point to the kitten
list. Thoughts? Are there any other updates needed for 5802?
>
> Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any
other SCRAM mechanism?
>

Let me counter that with a question. Why pick SHA-256 in particular? Why
not jump to SHA-512, or SHA-3?

>     Tony Hansen
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>

v2.29.0 | Report a Bug | By Email | System Status