Subject: SASL Registration list online

From: Chris Newman <[email-masked]>
Date: Tue, 02 Dec 1997 12:49:55 -0800 (PST)

The SASL mechanism registration list is now online at:

   <ftp://ftp.isi.edu/in-notes/iana/assignments/sasl-mechanisms>

with a link from the IANA web page.  The list currently includes:

KERBEROS_V4, GSSAPI, SKEY, EXTERNAL, CRAM-MD5 and ANONYMOUS.

Other mechanisms in the works:
PLAIN in draft-newman-sasl-plaintrans-04.txt, which I'm aiming for
publication as an informational RFC.  I don't expect the mechanism to
change at this point.

SCRAM-MD5 in draft-newman-sasl-scram-01.txt which will undergo one more
incompatible revision and some security review before hopefully going
standards track.  It's intended to fix some flaws in CRAM-MD5 with roughly
equivalent complexity level and marginally better security.  Should be
good for thin clients with no backwards compatibility requirement.

I'm also working on a PASS-DSS-SHA-3DES-1 mechanism which will use the
same security model that the mandatory to implement mechanisms in 
draft-ietf-secsh-transport-03.txt use, except just for encrypting the
client password.  Should be viable for situations with a backwards
compatiblity requirement.  I may have a pre-release spec to circulate to
interested parties at the IETF.

I don't know if anyone is working on an OTP/RFC 2243 mechanism or 
SRP/B-SPEKE style mechanisms.

		- Chris