Subject: [kitten] SASL's idea of "additional data" in a protocol

From: Rick van Rein <[email-masked]>
Date: Thu, 19 Mar 2020 09:49:03 +0100

Hello,

RFC 4422 states that there may be additional data with a success.  I
don't think I have ever seen this in any protocol or mechanism.  Am I
correct that there is no reason in practice to add it to a protocol
embedding of SASL?

The text is,

   Some mechanisms specify that the server is to send additional data to
   the client when indicating a successful outcome.  Protocols may
   provide an optional additional data field in the outcome message to
   carry this data.  Where the mechanism specifies that the server is to
   return additional data with the successful outcome, the protocol
   provides an optional additional data field in the outcome message,
   and the server uses this field, the exchange is shortened by one
   round-trip:

Thanks,
 -Rick

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 19 Mar 2020 13:30:52 +0000

Hi Rick,

> correct that there is no reason in practice to add it to a protocol

Actually, this is being used. Look for example at SCRAM (RFC 5802), the 
last message from the server (containing the v= attribute) can be sent 
as "additional data with success". It is always better to allow for this 
in a SASL protocol profile in order to save an extra round trip. I.e. if 
this feature is not supported by a protocol, the server will have to 
send it as a regular SASL response, to which the client will have to 
respond with an empty challenge, which will then be responded to by the 
server with just successful outcome (with no data).

Best Regards,

Alexey

> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten

---

From: Rick van Rein <[email-masked]>
Date: Thu, 19 Mar 2020 16:54:01 +0100

Hello Dave and Alexey,

> SCRAM does this, and it can be seen in profiles that support it like XMPP.

> Actually, this is being used. Look for example at SCRAM (RFC 5802),
> the last message from the server (containing the v= attribute) can be
> sent as "additional data with success".

Thanks, my feeling that this was not used at else has been falsified.  I
was beginning to wonder if I was being overzealously spec-compliant.
Apparently not :)

-Rick