Subject: Re: [kitten] AD review of draft-ietf-kitten-sasl-saml-ec-19

From: Simon Josefsson <[email-masked]>
Date: Thu, 15 Oct 2020 21:12:28 +0200

Robbie Harwood <[email-masked]> writes:

> "Cantor, Scott" <[email-masked]> writes:
>
>> While I appreciate the detailed review, mostly for my own educational
>> purposes, I simply don't have anything close to the cycles it would
>> take to redo the document to such a degree. Nobody is funding me to
>> work on it, and events have long since overtaken it.
>>
>> I was hoping that it was more or less close to workable, and it's a
>> vast improvement over the clearly-broken SAML and OAuth mechanisms
>> that got rubber-stamped a long while back. That mistake is frankly
>> what really motivated me at the time to work on it, but that was many
>> years ago now.
>
> Appreciate your frankness here.  With my shepherd hat on:
>
> Simon, do you think you have cycles to take this on?

Hi.  Apparently, I don't either.  I would appreciate help with it.

The reason for my lack of enthusiasm is my deployment experience with
the "rubber-stamped" SAML SASL mechanism.  I implemented it and it
worked fine.  Scott's SAML-EC approach would work even better and
provide better security and more features.  However neither provide
anything that is likely to work in the real world with IMAP, SMTP and
other common protocols: the problem is that client applications expect
to open up tens of sessions to the server, and that authentication has
to be quick and automatic for the user experience to work well.

There are many ideas on how to solve that problem, and I believe we have
discussed this before, but it is not realistic for me to find time to
work on that problem now, and until that work is ready, working on
SAML-EC has not felt worthwhile for me since it would have the same
usability issue.

/Simon