Message-ID: <53475A88.3060202@att.com>
Date: Thu, 10 Apr 2014 22:59:20 -0400
From: Tony Hansen <tony@att.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: kitten@ietf.org
References: <RT-Ticket-748877@icann.org> <5319DE8B.1030202@att.com>
 <rt-4.0.8-12541-1394569374-953.748877-9-0@icann.org>
 <20140312162849.152e924b@latte.josefsson.org>
 <20140411001759.3d89cfb5@latte.josefsson.org>
 <CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com>
In-Reply-To: <CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------030607050304010800050405"
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/dx1tAHnCi4uPoG4ySvdEyvvkI9M
Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256
Precedence: list

This is a multi-part message in MIME format.
--------------030607050304010800050405
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 4/10/14, 7:10 PM, Dave Cridland wrote:
> On 10 April 2014 23:17, Simon Josefsson <simon@josefsson.org 
> <mailto:simon@josefsson.org>> wrote:
>
>     I haven't seen anyone disagree with my interpretation that the
>     registration policy for new SCRAM-* mechanisms are "IETF Review",
>     which
>     requires an RFC.  Therefor, I will suggest to IANA that they turn down
>     the registration request until that has been fulfilled.
>
>
>
> Yes, they're IETF Review.
>
> Although RFC 5802 is generally hash agnostic, a handful of parts of 
> SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the 
> minimum iteration count for example, so an RFC might prove useful anyway.

OK, I figured it was worth trying to do it this way. I'll start the RFC 
process.

Dave, a question for you: What do you think a better minimum iteration 
count should be for SCRAM-SHA-256? Why should it be any different than 
the value specified for SCRAM-SHA-1 (4096)?

One of the items in 5802 that is out of date is the email address to 
send registrations to, as it specifies sasl@ietf.org which no longer 
exists. So I think an update to that part of 5802 is needed to point to 
the kitten list. Thoughts? Are there any other updates needed for 5802?

Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any 
other SCRAM mechanism?

     Tony Hansen

--------------030607050304010800050405
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    On 4/10/14, 7:10 PM, Dave Cridland wrote:<br>
    <blockquote
cite="mid:CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote">On 10 April 2014 23:17, Simon
            Josefsson <span dir="ltr">&lt;<a moz-do-not-send="true"
                href="mailto:simon@josefsson.org" target="_blank">simon@josefsson.org</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">I
              haven't seen anyone disagree with my interpretation that
              the<br>
              registration policy for new SCRAM-* mechanisms are "IETF
              Review", which<br>
              requires an RFC. &nbsp;Therefor, I will suggest to IANA that
              they turn down<br>
              the registration request until that has been fulfilled.<br>
            </blockquote>
            <div><br>
            </div>
            <div><br>
            </div>
            <div>Yes, they're IETF Review.</div>
            <div><br>
            </div>
            <div>Although RFC 5802 is generally hash agnostic, a handful
              of parts of SCRAM are defined specific to
              SCRAM-SHA-1[-PLUS], including the minimum iteration count
              for example, so an RFC might prove useful anyway.</div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    OK, I figured it was worth trying to do it this way. I'll start the
    RFC process.<br>
    <br>
    Dave, a question for you: What do you think a better minimum
    iteration count should be for SCRAM-SHA-256? Why should it be any
    different than the value specified for SCRAM-SHA-1 (4096)?<br>
    <br>
    One of the items in 5802 that is out of date is the email address to
    send registrations to, as it specifies <a class="moz-txt-link-abbreviated" href="mailto:sasl@ietf.org">sasl@ietf.org</a> which no longer
    exists. So I think an update to that part of 5802 is needed to point
    to the kitten list. Thoughts? Are there any other updates needed for
    5802?<br>
    <br>
    Another question: should an RFC for SCRAM-SHA-256[-PLUS] register
    any other SCRAM mechanism?<br>
    <br>
    &nbsp;&nbsp;&nbsp; Tony Hansen<br>
  </body>
</html>

--------------030607050304010800050405--