Re: [kitten] Fwd: I-D Action: draft-melnikov-scram-2fa-00.txt

[Alexey Melnikov <[e-mail]>]

Hi Florian,

On 19/03/2020 13:53, Florian Schmaus wrote:
> On 3/19/20 2:25 PM, Alexey Melnikov wrote:
>> Hi all,
>>
>> As I had various conversations with people saying that SASL doesn't
>> support 2 factor authentication, I posted a short draft which shows how
>> to add 2 factor authentication to SCRAM. This is mostly a proof of
>> concept and I am planning to work on another draft explaining how to do
>> the same for SASL OAUTH.
>>
>> (If I remember correctly I also talked to Dave Cridland about doing a
>> more generic extension to the SASL framework itself by allowing
>> protocols to invoke multiple SASL mechanism in a sequence and achieving
>> 2FA that way. I would be interested in developing this concept as well,
>> but it would take longer than just extending some existing SASL mechanisms.)
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-melnikov-scram-2fa/
>>
>> If people can have a look and provide feedback, that would be much
>> appreciated.
> How does the client discover that the SCRAM 2FA extension is required?
> Is it encoded in the SASL mechanism name, akin to SCRAM -PLUS?

It could be done this way.

I was also thinking about not introducing new SASL mechanism names and 
just add a mandatory attribute in the first message from the server to 
the client.

If you have an opinion on these options, please let me know.

Best Regards,

Alexey