Re: Poll: pure SCRAM versa SCRAM-as-GS2

[Alexey Melnikov <[e-mail]>]

Nicolas Williams wrote:

>On Tue, Feb 10, 2009 at 12:17:32PM -0800, Kurt Zeilenga wrote:
>  
>
>>Question regarding the GS2-SCRAM specification.
>>
>>I see no language in draft-newman-auth-scram-gs2-00.txt which says  
>>whether it or the specifications detailing the SASL-GS2, GSS-API, GSS- 
>>API-SCRAM are definitive.
>>
>>Which will be?
>>
>>I don't think 'neither' or 'both' is an appealing (to me) answer here.
>>    
>>
>Certainly "neither" is not a good answer, because then there'd be no
>authoritative specification :)
>
>However, SCRAM-as-GS2 must stand on its own if pure-SASL implementors
>are to be happy, yet it needs to conform to GS2 if we are to have
>interop with SASL/GS2 implementors.
>  
>
I agree with both statements.

>>I would argue that if we further pursue the scram-gs2 approach, I  
>>would favor the approach suggested by Simon.  That is, SCRAM-GS2 be  
>>informational.   I would add that SCRAM-GS2 should include text that  
>>clearly states it is not definitive.
>>    
>>
>I'd be happy with that.
>
I would be less happy about that and I don't think a statement like this 
is going to be helpful, even if it is true.

>But pure SASL implementors might not be, in
>which case we'll need to make a) the SCRAM specification independent of
>GS2 yet b) conformant to it.  I have long assumed we'd have to do just
>that.
>  
>