IETF Logo Mail Archive

Re: [kitten] [IANA #748877] please review SASL-SCRAM-256

Simon Josefsson <simon@josefsson.org> Fri, 11 April 2014 08:46 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDC1A1A044A for <kitten@ietfa.amsl.com>; Fri, 11 Apr 2014 01:46:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.551
X-Spam-Level:
X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jEDsl0zCQ5B2 for <kitten@ietfa.amsl.com>; Fri, 11 Apr 2014 01:46:43 -0700 (PDT)
Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) by ietfa.amsl.com (Postfix) with ESMTP id 5BE731A043F for <kitten@ietf.org>; Fri, 11 Apr 2014 01:46:42 -0700 (PDT)
Received: from latte.josefsson.org (46.182.205.36.c.fiberdirekt.net [46.182.205.36]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id s3B8kak9008042 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 11 Apr 2014 10:46:38 +0200
Date: Fri, 11 Apr 2014 10:46:31 +0200
From: Simon Josefsson <simon@josefsson.org>
To: Dave Cridland <dave@cridland.net>
Message-ID: <20140411104631.15ffa951@latte.josefsson.org>
In-Reply-To: <CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com>
References: <RT-Ticket-748877@icann.org> <5319DE8B.1030202@att.com> <rt-4.0.8-12541-1394569374-953.748877-9-0@icann.org> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <CAKHUCzxxbABfJDR8JZ5evHXFHmsBvqVdHTX0QLg4ONsqNKgk5g@mail.gmail.com>
X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: clamav-milter 0.98.1 at duva.sjd.se
X-Virus-Status: Clean
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/zfOUa3dT82kQ3dowIfG06XJX_6I
Cc: kitten@ietf.org
Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Apr 2014 08:46:48 -0000

You wrote:

> On 10 April 2014 23:17, Simon Josefsson <simon@josefsson.org> wrote:
> 
> > I haven't seen anyone disagree with my interpretation that the
> > registration policy for new SCRAM-* mechanisms are "IETF Review",
> > which requires an RFC.  Therefor, I will suggest to IANA that they
> > turn down the registration request until that has been fulfilled.
> 
> Yes, they're IETF Review.

Although I noticed now that RFC 4402 says family mechanism instances are
expert review, so the requirements is a bit confusing.  However I think
what's in RFC 5802 has more weight regarding SCRAM, and I think this
was actually discussed before.

> Although RFC 5802 is generally hash agnostic, a handful of parts of
> SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the
> minimum iteration count for example, so an RFC might prove useful
> anyway.

Yes, that and the GSS-API OID.

/Simon

v2.29.0 | Report a Bug | By Email | System Status