Re: [kitten] Register too long SASL mechs?

[Jeffrey Altman <[e-mail]>]

On 5/26/2021 9:48 AM, Simon Josefsson 
(simon=[e-mail]) wrote:
> Hi!  There is a request to register the ECDH-X25519-CHALLENGE and
> ECDSA-NIST256P-CHALLENGE mechanism names in the IANA SASL registry.  The
> policy is First Come First Serve, so there is no real requirement of a
> standard or anything, however the names are longer than the 20 character
> limit imposed by RFC 4422.  Supposedly these are already deployed and
> have been used in the wild for a couple of years already.
> 
> Some references:
>    https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

The registration page explicitly mentions the 20 character limit

>    https://github.com/atheme/atheme/blob/master/modules/saslserv/ecdh-x25519-challenge.c

2019

>    https://github.com/kaniini/ecdsatool#mechanism-spec

2016 - described as "proposed"

> As far as I can see, we have some options:
> 
> 1) Just let IANA register these names even if they are non-compliant.
> 
> 2) Don't formally register them but mention them on the IANA page to
> avoid any interop problems and allowing people to find out what these
> are.
> 
> 3) Refuse registration since tey are non-compliant.
> 
> I prefer 2) but could live with 1) as well.  I don't think it is in the
> best interest of anybody that registration is refused on technicalities.
> Maybe this post is sufficient to make relevant parties aware of what is
> happening, and IANA can continue with 1).
> 
> Thoughts?

There is a fourth option.  A request for registration implies that the 
mechanisms are actively supported.  We can require that they register a 
RFC4222 compliant name and implement that name.  They will need to of 
course support accepting both the "too long" name and the registered name.

On the registration page a note could be added next to the registered 
name with the "too long" name and the mechanism version in which the 
name was fixed.

Continued use of "too long" names is an interoperability risk for their 
end users.

Am I curious how the "too long" names are working today.

Do SASL implementations not enforce the name length restriction?

Do SASL implementations truncate the name to 20 characters?

Jeffrey Altman