Re: [kitten] Comments on draft-ietf-kitten-password-storage-00

[Sam Whited <[e-mail]>]

On Sun, Nov 22, 2020, at 12:04, Ludovic BOCQUET wrote:
> After my previous comments, maybe it is not clear to all in this
> list, sorry.

I apologize for the confusion, but I am still not sure what you are
advocating for in this email. It appeared that you want the order that
Alexey suggested, which I already said I would update in the next draft.

It also appears that you're asking again for me to add references to the
various new SCRAM mechanisms, but as I have already told you I plan on
waiting a bit. There is no harm in waiting for more feedback on them
before referencing them in this I-D.


> Please read my comments after.

I am not sure what comments you are referring to.


> I have never said finalize today or tomorrow. And other parts can be
> improved.

I apologize, I thought when you said "The final 'draft-ietf-kitten-password-
storage' must be validated like a RFC after the next two I-Ds, it is
really important" you meant that we should move password-storage to RFC
after two more drafts and this is what I was pushing back on. I am sorry
if I misunderstood.


> - "draft-ietf-kitten-tls-channel-bindings-for-tls13" I-D updates or
>   obsoletes RFC5929 (but it is not specified in header)

I'm not sure if this is true or not. Maybe it just updates them since
they are still valid for TLS 1.2? I could go either way. I will make a
note that this needs updating in a future revision. Thanks.


> - "draft-ietf-kitten-password-storage" I-D updates RFC8600 (but it is
>   not specified in header)

I don't think this one is true unless we're going to count this as
updating every single protocol that uses SCRAM.


> Do not forget that: 1 - CRAM-MD5 to Historic:
> - https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00
>   // 20 November 2008
> - https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00
>   // June 29, 2017

I don't think we need to reference every obsolete hashing mechanism, I
just mentioned that old MD5 mechanisms aren't a good idea in the example
of how to order mechanisms.

> Maybe it is time to take them off completely from the list even if
> they are after PLAIN.

They are off the list, the only place they are mentioned is in an
example of how to order mechanisms. If this is causing confusion maybe
they shouldn't be mentioned there either though. I'll consider it for
the next draft.

Thank you for your feedback. I'm sorry if I missed anything, it was a
very long email and included feedback on multiple I-Ds. In future it
might be best to provide feedback for different I-Ds in different
threads. Hopefully I responded to all the important bits.

—Sam