Subject: [kitten] SCRAM for GSS-API

From: Gerd Stolpmann <[email-masked]>
Date: Sun, 06 Feb 2011 16:49:05 +0100

Hello,

I'm implementing SCRAM (RFC 5802) for GSS-API. In my opinion, the text
has a few imprecise statements, and I'd like to clarify on them.

In particular, the question is how to interpret section 8, which reads 

  "The messages are the
   same, but a) the GS2 header on the client's first message and channel
   binding data is excluded when SCRAM is used as a GSS-API mechanism,
   and b) the RFC2743 section 3.1 initial context token header is
   prefixed to the client's first authentication message (context
   token)."

The exclusion (removal?) of the GS2 header probably means that the
production for gs2-header should read

	gs2-header = epsilon

which is also compatible with RFC 5801 (GS2). However, the wording is
not really precise. Another problem is the removal of the channel
binding data (the sentence is quite strange English in this respect).
This occurs in client-final-message-without-proof, which is defined as

   client-final-message-without-proof =
                     channel-binding "," nonce ["," extensions]

So, how to remove channel binding data here? It needs to be removed,
because it is essentially a copy of the channel binding that might be in
gs2-header. I've interpreted this as

   client-final-message-without-proof =
                     nonce [","  extensions]

but this is pure speculation. It is quite important that this is
non-ambiguous because the client messages are input for the client
proof, and the authentication will fail for each misinterpreted comma.

If you are interested, my (still incomplete) code is in

https://godirepo.camlcity.org/svn/lib-ocamlnet2/trunk/code/src/netmech-scram/netmech_scram.ml

Are there any other implementations of SCRAM for GSS-API?

Gerd
-- 
------------------------------------------------------------
Gerd Stolpmann, Bad Nauheimer Str.3, 64289 Darmstadt,Germany 
[email-masked]          http://www.gerd-stolpmann.de
Phone: +49-6151-153855                  Fax: +49-6151-997714
------------------------------------------------------------

---

From: Luke Howard <[email-masked]>
Date: Tue, 8 Feb 2011 09:32:18 +1100

> Are there any other implementations of SCRAM for GSS-API?

This might help:

http://www.project-moonshot.org/gitweb/?p=cyrus-sasl.git;a=blob;f=plugins/gs2.c

-- Luke