Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256

From: Simon Josefsson <[email-masked]>
Date: Wed, 12 Mar 2014 16:28:49 +0100

Dear all,

We have received a request to register the SCRAM-SHA-256 and
SCRAM-SHA-256-PLUS mechanism.  According to my understanding of what RFC
5802 section 10 says, the registration process is "IETF Review"
http://tools.ietf.org/html/rfc5226#page-11 which requires an RFC, but I
may be mistaken.  Anyway, suggestions on how to deal with the
registration request is appreciated.

Having a SCRAM with SHA-256 seems like a fairly non-controversial
thing to me.  There are interop aspects though, and the utility of
defining a lot of variants could be debated.  I would like to see a
GSS-API OID registered at the same time for any new SCRAM-SHA-* family
member, but it seems we forgot to write a policy to make sure that
happens.  Other thoughts?

/Simon

You wrote:

> Dear Simon,
> 
> IANA has received a request from Tony Hansen ([email-masked]) for two
> new registrations in the SASL Mechanisms registry at
> http://www.iana.org/assignments/sasl-mechanisms. 
> 
> Please let us know when the two-week review period on [email-masked]
> is complete.
> 
> thanks,
> 
> Amanda Baber
> IANA Request Specialist
> ICANN
> 
> ===
> 
> IANA, please register the following:
> 
> To: [email-masked]
> Subject: Registration of a new SASL mechanism SCRAM-SHA-256
> 
> SASL mechanism name (or prefix for the family): SCRAM-SHA-256
> Security considerations: Section 7 of [RFC5802]
> Published specification (optional, recommended): [RFC5802]
> Person & email address to contact for further information:
> IETF SASL WG <[email-masked]>
> Intended usage: COMMON
> Owner/Change controller: IESG <[email-masked]>
> Note:
> 
> To: [email-masked]
> Subject: Registration of a new SASL mechanism SCRAM-SHA-256-PLUS
> 
> SASL mechanism name (or prefix for the family): SCRAM-SHA-256-PLUS
> Security considerations: Section 7 of [RFC5802]
> Published specification (optional, recommended): [RFC5802]
> Person & email address to contact for further information:
> IETF SASL WG <[email-masked]>
> Intended usage: COMMON
> Owner/Change controller: IESG <[email-masked]>
> Note:
>

---

From: Shawn M Emery <[email-masked]>
Date: Sun, 16 Mar 2014 17:54:46 -0600

> registration request is appreciated.

Typing as an individual... the mechanism name seems to be very much in 
keeping with guidance provided in 5802 section 4.

> member, but it seems we forgot to write a policy to make sure that

I don't envision that there will be a proliferation of SCRAM-SHA-* 
mechanism variations.  Certainly if we can keep to a small set of output 
sizes per algorithm.

Shawn.
-- 
>> Please let us know when the two-week review period [email-masked]
>> is complete.
>>
>> thanks,
>>
>> Amanda Baber
>> IANA Request Specialist
>> ICANN
>>
>> ===
>>
>> To:[email-masked]
>> IETF SASL WG<[email-masked]>
>> Intended usage: COMMON
>> Owner/Change controller: IESG<[email-masked]>
>> Note:
>>
>> To:[email-masked]
>> IETF SASL WG<[email-masked]>
>> Intended usage: COMMON
>> Owner/Change controller: IESG<[email-masked]>
>> Note:
>>
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>
>