Subject: draft-burdis-cat-srp-sasl-05

From: Ken Murchison <[email-masked]>
Date: Mon, 03 Dec 2001 16:23:01 -0500

Keith,

Is there any technical reason why the authorization id (I) is sent in a
separate exchange from the authentication id (U)?  I notice in draft -03
that they used to be sent in the same exchange, but U was pulled out in
draft -04 to make SRP a client-first mechanism instead of a server-first
mech.  Why weren't they moved together?

The reason that I ask is that I'm working on a SRP plugin for the CMU
SASL implementation (using Tim Martin's work as a very good and almost
complete starting point).  I ran into a problem which technically
appears to be an issue with the SASL C API, but can easily be resolved
with a minor change to the SRP exchanges.

I won't get into the details of the C API problem unless someone
needs/wants to know, but I'd like to suggest that 'I' be sent with 'U',
ie:

Client  ---  { utf8(U) | utf8(I) } ------------------->  Server

Client  <--- { mpi(N) | mpi(g) | os(s) | utf8(L) }  ---  Server

Client  ---  { mpi(A) | utf8(o) }  ------------------->  Server

...

I don't see how this change would have any negative impact, and it would
also bring SRP more in line with the other SASL mechs that allow for
proxying (PLAIN and OTP) which send the authid and authzid in the
initial client request.

Regards,
Ken
-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp