Re: a dedicated SASL WG

["Kurt D. Zeilenga" <[e-mail]>]

I actually intended to chat with JeffS and JohnM regarding
rechartering of the (concluded) SASL WG at IETF#50...  here
are my thoughts.

I believe the IETF needs to undertake the revision of
SASL [RFC2222] and select SASL mechanisms to Draft
Standard status as soon as possible so as not to
impede the progress of IETF work dependent on RFC2222.
I firmly believe that SASL itself and select mechanisms
are suitable for publication as a Draft Standard.

Hence, I would be supportive of chartering the
a working group to take SASL and a few select mechanisms
to Draft Standard status, in particular EXTERNAL, PLAIN,
and DIGEST-MD5.

Though this WG could also take on engineering of new
mechanisms (including a replacement for GSSAPI), I believe
this should be viewed as secondary to the above objective.
I believe specification of many mechanisms should be done
by other working groups or on an individual basis.

I would recommend against taking on the Java SASL API work.
The Java Community Program is working in this area and the
IETF should avoid competing with the JCP.

I also believe the use of SASL by application protocol
should be left to Application Area working groups.

        Kurt

At 06:39 AM 3/11/01 +1100, Raif S. Naffah wrote:
>hi there,
>
>There are currently many SASL-related drafts other than the one (SASL GSS-API mechanisms <http://search.ietf.org/internet-drafts/draft-ietf-cat-sasl-gssapi-02.txt>) listed under the Common Authentication Technology WG drafts, namely:
>
>A. new SASL mechanisms:
>
>   1. Secure Remote Password SASL Mechanism
>   <http://search.ietf.org/internet-drafts/draft-burdis-cat-srp-sasl-04.txt>
>
>   2. SM2 -- A Session Management Capable SASL Mechanism
>   <http://search.ietf.org/internet-drafts/draft-naffah-cat-sasl-sm2-00.txt>
>
>   3. X.509 Authentication SASL Mechanism
>   <http://search.ietf.org/internet-drafts/draft-ietf-ldapext-x509-sasl-03.txt>
>
>   4. ISO/IEC 9798-3 Authentication SASL Mechanism
>   <http://search.ietf.org/internet-drafts/draft-zuccherato-9798-3-sasl-02.txt>
>
>B. Java SASL API:
>
>   5. The Java SASL Application Program Interface
>   <http://search.ietf.org/internet-drafts/draft-weltman-java-sasl-04.txt>
>
>C. Using SASL with other protocols:
>
>   6. Upgrading to SASL Within HTTP/1.1
>   <http://search.ietf.org/internet-drafts/draft-burdis-http-sasl-00.txt>
>
>   7. SASL in HTTP/1.1
>   <http://search.ietf.org/internet-drafts/draft-nystrom-http-sasl-00.txt>
>
>   8. LDAP Authentication Response Control
>   <http://search.ietf.org/internet-drafts/draft-weltman-ldapv3-auth-response-03.txt>
>
>
>As clarified by the Common Authentication Technology (CAT) WG Chair, John Linn, SASL mechanisms, APIs, and SASL/protocol integration documents have not been work items of the CAT-WG, and CAT has itself been placed in an idle state, pending on possible advancement of its existing RFCs but not undertaking new work.
>
>My question to the list is: how ready, and/or willing, is the SASL community to charter a new WG dedicated to SASL?
>
>
>TIA + cheers;
>rsn
>
>cc: John Linn, Jeffrey Schiller, Marcus Leech.