Re: [kitten] [Technical Errata Reported] RFC6616 (7074)

[Simon Josefsson <[e-mail]>]

I agree.

/Simon

RFC Errata System <[e-mail]> writes:

> The following errata report has been submitted for RFC6616,
> "A Simple Authentication and Security Layer (SASL) and Generic
> Security Service Application Program Interface (GSS-API) Mechanism for
> OpenID".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7074
>
> --------------------------------------
> Type: Technical
> Reported by: Nadja Reitzenstein <[e-mail]>
>
> Section: 2.1
>
> Original Text
> -------------
> The nonce value MUST be at least 2^32 bits and large enough to 
> handle well in excess of the number of concurrent transactions 
> a SASL server shall see.
>
> Corrected Text
> --------------
> The nonce value MUST be at least 32 bits and large enough to 
> handle well in excess of the number of concurrent transactions 
> a SASL server shall see.
>
> Notes
> -----
> A nonce of 512MiB is rather excessive to be generated for every authenticating client.
>
> As this nonce also has to be transported within the URI sent to both
> the SASL client and called by the OIDC IdP the Note in section 3.2.1
> of RFC 2616 seems to apply:
> "Servers ought to be cautious about depending on URI lengths above 255
> bytes, because some older client or proxy implementations might not
> properly support these lengths."
>
> A lower bound requirement of 32 bits for the nonce seems more
> appropiate; most platforms are able to efficiently handle 32-bit
> integers and is still likely to prevent a brute-force attack given the
> HTTP request overhead.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
>
> --------------------------------------
> RFC6616 (draft-ietf-kitten-sasl-openid-08)
> --------------------------------------
> Title : A Simple Authentication and Security Layer (SASL) and Generic
> Security Service Application Program Interface (GSS-API) Mechanism for
> OpenID
> Publication Date    : May 2012
> Author(s)           : E. Lear, H. Tschofenig, H. Mauldin, S. Josefsson
> Category            : PROPOSED STANDARD
> Source              : Common Authentication Technology Next Generation
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG