Re: [kitten] Fwd: I-D Action: draft-hansen-scram-sha256-01.txt

On 7/24/14 4:57 PM, Tony Hansen wrote:
> I just posted this update to the document I circulated back in April, 
> registering SCRAM-SHA-256 as a SASL mechanism.
>
> I added Minimum iteration-count and OID to the registration form for 
> SCRAM-* registrations.
>
> I kept the minimum iteration count for SCRAM-SHA-256 set at 4096. This 
> should probably be discussed further.

I know RFC 3962 calls for 4096 rounds for SHA-1.  I haven't heard of 
anything that would make us want to change this.  Are there specific 
use-cases for this mechanism that would be negatively affected when 
choosing a higher iteration or is there guidance on policies when using 
this number of iterations or lower?

> One question I have for this: would it be worth change SCRAM 
> registrations to Expert Review in place of IETF review?

Do you envision a number of future mechanisms under the SCRAM* family?  
If not then I would prefer leaving it as IETF review.

> There was discussion in the HTTPAUTH working group this morning, 
> asking about the use of SHA2 as an HTTP mechanism instead of the SHA1 
> being discussed in Alexey's draft.
>
> An open question is whether this could/should become a working group 
> draft. I am happy with it being handled either that way or keeping it 
> an individual AD-sponsored draft. (I've already spoken with Steven and 
> Kathleen about that possibility.)

Speaking as co-chair; it has been a strain on the WG's resources with 
getting through the previous and current set of SASL work items.  So my 
initial position on this would be to have this draft AD-sponsored.

Shawn.
--
> -------- Original Message --------
> Subject: 	I-D Action: draft-hansen-scram-sha256-01.txt
> Date: 	Thu, 24 Jul 2014 15:49:56 -0700
> From: 	internet-drafts@ietf.org
> Reply-To: 	internet-drafts@ietf.org
> To: 	i-d-announce@ietf.org
>
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>
>
>          Title           : SCRAM-SHA-256 and SCRAM-SHA-256-PLUS SASL Mechanisms
>          Author          : Tony Hansen
> 	Filename        : draft-hansen-scram-sha256-01.txt
> 	Pages           : 5
> 	Date            : 2014-07-24
>
> Abstract:
>     This document registers the SASL mechanisms SCRAM-SHA-256 and SCRAM-
>     SHA-256-PLUS.  It also updates RFC 5802 in minor ways.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-hansen-scram-sha256/
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-hansen-scram-sha256-01
>
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-hansen-scram-sha256-01
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten