Re: [kitten] draft-hansen-scram-sha256 and incorporating session hashing for channel binding

[Tony Hansen <[e-mail]>]

On 5/23/15 10:27 AM, Simon Josefsson wrote:
> ...
> This text has nothing to do with the tls-session-hash issue? 

Sorry, it has the text I added because of earlier issues brought up
within this thread. No, it doesn't address tls-session-hash.

> If you don't want to ship a known insecure protocol, I believe the
> options are to either include text similar to what I proposed above,
> or to replace tls-unique with a secure TLS channel binding (e.g.,
> draft-josefsson-sasl-tls-cb). Shipping a known insecure protocol is
> another option, but then you should add a security consideration
> explaining that tls-unique is not secure without tls-session-hash and
> that consistency with (the also insecure) RFC 5802 was deemed more
> important security.

Your suggested text is:

    "To be secure SCRAM-SHA-256-PLUS has to be used over a TLS channel
that MUST have [TLS-SESSION-HASH] negotiated."

You then go on to say: "Personally, I would prefer to change to another
mandatory channel binding that is secure for all TLS versions."

Given the other comments in this thread, I'm not sure the suggested text
is the right thing to add.

    Tony Hansen