Re: [kitten] Register too long SASL mechs?

[Simon Josefsson <[e-mail]>]

Simo Sorce <[e-mail]> writes:

> On Wed, 2021-05-26 at 15:48 +0200, Simon Josefsson wrote:
>> Hi!  There is a request to register the ECDH-X25519-CHALLENGE and
>> ECDSA-NIST256P-CHALLENGE mechanism names in the IANA SASL registry.  The
>> policy is First Come First Serve, so there is no real requirement of a
>> standard or anything, however the names are longer than the 20 character
>> limit imposed by RFC 4422.  Supposedly these are already deployed and
>> have been used in the wild for a couple of years already.
>> 
>> Some references:
>>   https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml
>>   https://github.com/atheme/atheme/blob/master/modules/saslserv/ecdh-x25519-challenge.c
>>   https://github.com/kaniini/ecdsatool#mechanism-spec
>> 
>> As far as I can see, we have some options:
>> 
>> 1) Just let IANA register these names even if they are non-compliant.
>> 
>> 2) Don't formally register them but mention them on the IANA page to
>> avoid any interop problems and allowing people to find out what these
>> are.
>> 
>> 3) Refuse registration since tey are non-compliant.
>> 
>> I prefer 2) but could live with 1) as well.  I don't think it is in the
>> best interest of anybody that registration is refused on technicalities.
>> Maybe this post is sufficient to make relevant parties aware of what is
>> happening, and IANA can continue with 1).
>> 
>> Thoughts?
>> 
>> Pursuing standardization, or publishing a stable specification, of the
>> mechanisms is orthogonal to registration, but would be useful.
>
> Is there any risk that using those names can cause issues to an
> implementation that conforms to RFC 4422 ?

Any implementation that don't support them would reject them as
unknown/invalid.  If it causes a vulnerability, that should be fixed
anyway.  So, no, not really, as far as I can see.

My biggest concern is that if we register them formally, we introduce an
inconsistency with RFC 4422, and should there ever be an RFC describing
them, that ought to extend RFC 4422 to increase permitted length and I'm
not sure that is a good idea.

IANA suggested that we can add a 'Note:' section to the registry where
these mechanisms are mentioned, including that they don't conform to the
particular format imposed by RFC 4422.

/Simon