Re: [kitten] [IANA #748877] please review SASL-SCRAM-256

[Tony Hansen <[e-mail]>]

On 4/10/14, 7:10 PM, Dave Cridland wrote:
> On 10 April 2014 23:17, Simon Josefsson <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     I haven't seen anyone disagree with my interpretation that the
>     registration policy for new SCRAM-* mechanisms are "IETF Review",
>     which
>     requires an RFC.  Therefor, I will suggest to IANA that they turn down
>     the registration request until that has been fulfilled.
>
>
>
> Yes, they're IETF Review.
>
> Although RFC 5802 is generally hash agnostic, a handful of parts of 
> SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the 
> minimum iteration count for example, so an RFC might prove useful anyway.

OK, I figured it was worth trying to do it this way. I'll start the RFC 
process.

Dave, a question for you: What do you think a better minimum iteration 
count should be for SCRAM-SHA-256? Why should it be any different than 
the value specified for SCRAM-SHA-1 (4096)?

One of the items in 5802 that is out of date is the email address to 
send registrations to, as it specifies [e-mail] which no longer 
exists. So I think an update to that part of 5802 is needed to point to 
the kitten list. Thoughts? Are there any other updates needed for 5802?

Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any 
other SCRAM mechanism?

     Tony Hansen