IETF Logo Mail Archive

Re: Poll: pure SCRAM versa SCRAM-as-GS2

Kurt Zeilenga <Kurt.Zeilenga@isode.com> Mon, 09 February 2009 21:13 UTC

Return-Path: <owner-ietf-sasl@mail.imc.org>
X-Original-To: ietfarch-sasl-archive-Zoh8yoh9@core3.amsl.com
Delivered-To: ietfarch-sasl-archive-Zoh8yoh9@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2BE913A6B5E for <ietfarch-sasl-archive-Zoh8yoh9@core3.amsl.com>; Mon, 9 Feb 2009 13:13:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bP9hHZkoZNyT for <ietfarch-sasl-archive-Zoh8yoh9@core3.amsl.com>; Mon, 9 Feb 2009 13:13:32 -0800 (PST)
Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id 1A1843A6B41 for <sasl-archive-Zoh8yoh9@ietf.org>; Mon, 9 Feb 2009 13:13:28 -0800 (PST)
Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n19LA0Vj031932 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 9 Feb 2009 14:10:00 -0700 (MST) (envelope-from owner-ietf-sasl@mail.imc.org)
Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id n19LA0vv031931; Mon, 9 Feb 2009 14:10:00 -0700 (MST) (envelope-from owner-ietf-sasl@mail.imc.org)
X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f
Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n19L9mjA031921 for <ietf-sasl@imc.org>; Mon, 9 Feb 2009 14:09:59 -0700 (MST) (envelope-from Kurt.Zeilenga@Isode.com)
Received: from [172.16.2.128] (shiny.isode.com [62.3.217.250]) by rufus.isode.com (submission channel) via TCP with ESMTPSA id <SZCbmQB0lL6d@rufus.isode.com>; Mon, 9 Feb 2009 21:09:46 +0000
Cc: SASL WG <ietf-sasl@imc.org>
Message-Id: <01AAA59C-9449-40FC-B9F1-1E7848A8D339@Isode.com>
From: Kurt Zeilenga <Kurt.Zeilenga@isode.com>
To: Alexey Melnikov <alexey.melnikov@isode.com>
In-Reply-To: <498B569C.7070400@isode.com>
Subject: Re: Poll: pure SCRAM versa SCRAM-as-GS2
Date: Mon, 09 Feb 2009 13:09:43 -0800
References: <498B569C.7070400@isode.com>
X-Mailer: Apple Mail (2.930.3)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Sender: owner-ietf-sasl@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-sasl/mail-archive/>
List-ID: <ietf-sasl.imc.org>
List-Unsubscribe: <mailto:ietf-sasl-request@imc.org?body=unsubscribe>

I would have assumed one difference between these two approaches is  
that if SCRAM were implemented as a GSA-API, the GS2- variant would be  
capable of providing a SASL security layer.  If that were so, this  
would lead to a significant interoperability problem as there would be  
two classes of support:
	non-GSS-API implementations: no security layer (use TLS)
	GSS-API implementations: GS2 security layer

Regardless of this, I simply don't thing scram-gs2 is "simple" enough.

I favor pursing publication of draft-newman-auth-scram-08.txt over  
draft-newman-auth-scram-gs2-00.txt for the SASL "SCRAM" mechanism.  I  
would not object to separate design/implementation of GSA-API SCRAM  
mechanism as I do think GSS-API needs something like SCRAM.

-- Kurt (chair hat off)

v2.23.0 | Report a Bug | By Email