Subject: [kitten] SCRAM and draft-ietf-kitten-tls-channel-bindings-for-tls13

From: Simon Josefsson <[email-masked]>
Date: Thu, 25 Mar 2021 10:41:47 +0100

Thanks for draft-ietf-kitten-tls-channel-bindings-for-tls13!  It is not
clear to me that it would actually modify anything for SCRAM/GS2, would
it?  Those documents still reference 'tls-uniqe' and things will still
be broken, as far as I can tell.  Should the new draft update the
SCRAM/GS2 specs?  I believe the channel binding flexibility in SCRAM/GS2
has been one complexity that has prevented adoption, but solving that
may be too late but we may be able to solve the security issues.  I see
that there is an 'Updates: 5802' but I can't find any text describing
what is intendted to be changed.

/Simon

---

From: "Sam Whited" <[email-masked]>
Date: Thu, 25 Mar 2021 08:10:34 -0400

I don't really know what "Updates" means in this context, so I just put
an RFC that uses tls-unique. The point wasn't so much that it changes
any normative text, but that this document should be discoverable from
5802 so that if you read "tls-unique" then go up to the top and see
"Updated by <new TLS 1.3 unique CB RFC>" you have a chance at finding
and implementing this instead.

On Thu, Mar 25, 2021, at 05:41, Simon Josefsson wrote:
> Thanks for draft-ietf-kitten-tls-channel-bindings-for-tls13!  It is
> not clear to me that it would actually modify anything for SCRAM/GS2,
> would it?  Those documents still reference 'tls-uniqe' and things will
> still be broken, as far as I can tell.  Should the new draft update
> the SCRAM/GS2 specs?  I believe the channel binding flexibility in
> SCRAM/GS2 has been one complexity that has prevented adoption, but
> solving that may be too late but we may be able to solve the security
> issues.  I see that there is an 'Updates: 5802' but I can't find any
> text describing what is intendted to be changed.

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 27 Mar 2021 20:08:36 +0100

> and implementing this instead.

That makes sense, but to me it isn't clear how I would actually
implement SCRAM (or GS2) when your draft is approved.  Are you
suggesting to replace tls-unique with something else?  There seems to be
some guidance missing.  There is backwards compatibility concerns with
changing the default channel binding.

/Simon