Re: Poll: pure SCRAM versa SCRAM-as-GS2

[Nicolas Williams <[e-mail]>]

On Tue, Feb 10, 2009 at 09:55:31AM -0800, Kurt Zeilenga wrote:
> On Feb 10, 2009, at 7:59 AM, Nicolas Williams wrote:
> >>Regardless of this, I simply don't thing scram-gs2 is "simple"  
> >>enough.
> >
> >Details.  Please provide details.
> 
> Of course, "simple" enough is quite subjective characteristic.   When  
> I first said this it was a gut reaction.  Here are some things which  
> lead me to my characterization of SCRAM-GS2 not being "simple" enough.

The WG has only been dealing with this for, what, two, three years, and
the chair is still going by gut reactions?

> Draft-newman-auth-scram-gs2-00.txt contains a normative reference to  
> draft-ietf-sasl-gs2-10.txt.  This implies an implementor must read and  
> understand draft-ietf-sasl-gs2-10.txt, as well as elements of its  
> normative references, in order to implement the protocol.  (I doubt  
> this normative reference can be downgraded.)

The normative reference is needed because though scram-gs2 is not
described as a GSS-API mechanism it needs to conform to GS2, and that is
only relevant to GS2 implementors, whereas SCRAM implementors who don't
have a GSS-API implementation need not implement GS2.

Thus this is not a real concern.

> The GS2 ABNF is twice as long.

Thank you, this is a relevant detail.  I'm not sure what we can do about
this, but I can take a look and see if there are simplifications we can
do.

> Not written in the GS2 specification, but needed to ensure broad
> adoption, is interoperability between the two classes of
> implementations.  Interoperability between classes of implementations
> is quite difficult to achieve in general, and the best way (I think)
> to avoid such interoperability problems is not to have classes of
> implementation.

SCRAM-as-GS2 is designed to be interoperable whether the implementor
chooses to implement it as a native SASL mechanism or as a GSS-API
mechanism used through GS2.

Nico
--