Re: [kitten] Comments on draft-ietf-kitten-password-storage-00

[Sam Whited <[e-mail]>]

Hi Ludovic,

On Thu, Oct 29, 2020, at 18:48, Ludovic BOCQUET wrote:
>  * "When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS
>    variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-
>    256 variants [RFC7677] SHOULD be preferred over SHA-1 variants
>    [RFC5802])"

I disagree with the RFC on this regard, but if further evidence can be
provided I'm all ears. There are no known pre-image attacks against SHA-
1, and the weaknesses I'm aware of at least won't matter for SCRAM since
SHA-1 is only used in the HMAC so to me it seems preferable to encourage
channel binding first, and the specific hash second. That being said,
channel binding isn't actually very useful right now since there's no
way to negotiate it and the existing methods are insecure without the
TLS master secret fix, so maybe it doesn't matter either way.

I am certainly not an expert and will bow to expert opinion if consensus
is against me, so I'd love more feedback on this.

> In the same time, I think that we must to add two new official SCRAM
> drafts of the same author of SCRAM:
>
> Currently SCRAM-SHA-512-PLUS and SCRAM-SHA-512 are missing:
> - https://tools.ietf.org/html/draft-melnikov-scram-sha-512
>
> Currently SCRAM-SHA3-512-PLUS and SCRAM-SHA3-512 are missing:
> - https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

I'm keeping an eye on those and am very excited to see them coming
along! I'd prefer that they go through expert review first though
before adding them to this document (although I do think it's
appropriate to do so since they're both just I-Ds right now, so I don't
feel strongly about this). I wouldn't want this document to go to RFC
and still be referencing those I-Ds, but I don't know what the IETF
position on this is; either way it seems worth waiting and keeping an
eye on them for now.

Thanks for your feedback!

—Sam