Subject: SASL questions: krb4, cleartext, code

From: Ken Raeburn <[email-masked]>
Date: Thu, 22 May 1997 01:58:50 -0400 (EDT)

Hi.  I've just joined the list.  Sorry if I'm rehashing anything that
hasn't made it to the mail-archive web site.

I've been looking over the SASL draft 10, with an eye towards using it
to negotiate authentication in CVS.  A few comments and questions have
come to mind.

Kerberos 4:

You require three round-trips to complete the authentication scheme.
But it seems to me that two round-trips should suffice, if client data
can be sent in the first message.  Is there some reason (other than
historical, relating to IMAP) that I'm missing?  I suppose it's too
late to change it....

Cleartext-password mechanisms:

I don't think there's any way I can get out of continuing to support
this in some form.  (I mean, really cleartext, not just passwords sent
over SSL-protected sessions.)  It's not secure, but the reality is
that it gets used.

Has someone confirmed, as Lyndon Nerenberg thought:
> Didn't Jeff Schiller state that the IETF was going to bounce any new
> security/authentication schemes incorporating cleartext passwords?

That would be unfortunate, since the schemes will exist anyways.  And
a mechanism for SASL would be more of an attempt to make such schemes
fit into a general authentication-negotiation protocol than an attempt
to promote insecure mechanisms.

Code:

Is there a publicly available implementation I can try out?  If not to
actually incorporate into CVS, at least to use for interoperability
testing?

Ken