Subject: [kitten] RFC5802: SCRAM

From: Jehan Pagès <[email-masked]>
Date: Mon, 22 Nov 2010 05:35:37 +0900

Hi,

I think I spotted a small wording mistake in the SCRAM RFC
(too bad the draft period is already finished, sorry I didn't
participate). In section 5:

«
The server verifies the nonce and the proof, verifies that the
  authorization identity (if supplied by the client in the first
  message) is authorized to act as the authentication identity, and,
  finally, it responds with a "server-final-message", concluding the
  authentication exchange.
»

I think the opposite was meant, wasn't it? This is the authentication
identity which acts as (if authorized to) the authorization identity.
It could be worded as:

«
  The server verifies the nonce and the proof, verifies that the
  the authentication identity is authorized to act as the
  authorization identity (if supplied by the client in the first
  message) , and, finally, it responds with a "server-final-message",
  concluding the authentication exchange.
»

Am I right?
Bye.

Jehan

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 21 Nov 2010 14:38:19 -0600

>   concluding the authentication exchange.

Yes, that's an editing error.  Thanks for catching that!

Nico
--

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 22 Nov 2010 07:57:13 +0000

>  concluding the authentication exchange.
Good catch. Can your report this as an erratum using 
<http://www.rfc-editor.org/errata.php> (press the "Report New Errata" 
button)?

---

From: Jehan Pagès <[email-masked]>
Date: Mon, 22 Nov 2010 19:50:48 +0900

Hi,

>> participate). In section 5:
[...]
> <http://www.rfc-editor.org/errata.php> (press the "Report New Errata"

Ok. I have done it. I have made it an "editorial" errata, not
technical, because even though it changes (even reverse) the meaning
of the text, the current one was not intended.
Bye.

Jehan

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 22 Nov 2010 10:11:43 -0600

> of the text, the current one was not intended.

Thanks!