[xmpp] RFC3920: SCRAM is an incomplete mechanism name

[Jehan Pagès <[e-mail]>]

Hi,

sorry I didn't take enough time lately for reviewing the whole lattest
draft. Still I have at least a remark about section "13.8.
Mandatory-to-Implement Technologies", the prefered mechanism « the
SASL Salted Challenge Response mechanism [SCRAM] » is not a full
mechanism name. It needs the underlying hash function.

Cf. section 4 of the SCRAM draft (
http://tools.ietf.org/html/draft-ietf-sasl-scram-11#section-4 ):
«
  A SCRAM mechanism name is a string "SCRAM-" followed by the
   uppercased name of the underlying hash function taken from the IANA
   "Hash Function Textual Names" registry (see http://www.iana.org),
   optionally followed by the suffix "-PLUS" (see below).
»

This is as though we had said that "DIGEST" was our preferred
mechanism at the time the DIGEST-MD5 was in the XMPP rfc. This is
inexact and too imprecise.

Of course we could say "any SCRAM mechanism", but if this is the case,
our text should be re-worded this way; because right now, it looks
like a XMPP server could advertise a mechanism simply named "SCRAM"
which does not exist by itself.

Yet I don't think such decision is the best option as it leaves too
much possibilities (there are like dozens of hash algorithm). We
should probably choose at least one preferred hash function to be used
inside SCRAM to make our preferred mechanism (eventually adding than
any additional SCRAM mechanism can be considered but not preferred).
What do you think of it? This point has never been raised on the list
(I must admit I don't read everything)?

Jehan

P.S.: note that the SCRAM draft asks all SCRAM implementations to
implement at least SCRAM-SHA1 for interoperability though we could
still decide for another one to be our "preferred" (like at least
using an algorithm of the SHA-2 family, or maybe SCRAM-MD5).