Re: Poll: pure SCRAM versa SCRAM-as-GS2

[Nicolas Williams <[e-mail]>]

On Tue, Feb 10, 2009 at 12:17:32PM -0800, Kurt Zeilenga wrote:
> Question regarding the GS2-SCRAM specification.
> 
> I see no language in draft-newman-auth-scram-gs2-00.txt which says  
> whether it or the specifications detailing the SASL-GS2, GSS-API, GSS- 
> API-SCRAM are definitive.
> 
> Which will be?
> 
> I don't think 'neither' or 'both' is an appealing (to me) answer here.

Certainly "neither" is not a good answer, because then there'd be no
authoritative specification :)

However, SCRAM-as-GS2 must stand on its own if pure-SASL implementors
are to be happy, yet it needs to conform to GS2 if we are to have
interop with SASL/GS2 implementors.

> I would argue that if we further pursue the scram-gs2 approach, I  
> would favor the approach suggested by Simon.  That is, SCRAM-GS2 be  
> informational.   I would add that SCRAM-GS2 should include text that  
> clearly states it is not definitive.

I'd be happy with that.  But pure SASL implementors might not be, in
which case we'll need to make a) the SCRAM specification independent of
GS2 yet b) conformant to it.  I have long assumed we'd have to do just
that.

Nico
--