Subject: Minutes for SASL working group at IETF 56

From: Sam Hartman <[email-masked]>
Date: Fri, 04 Apr 2003 14:37:18 -0500

Minutes based on notes from Chris Newman and Sam Hartman.

-----
SASL WG IETF 56 San Francisco

1. Base spec -- document editor is non-responsive, will assign new editor.

   Issue: Is security considerations sufficient to meet IESG review?

2. Anonymous
  went through WG last call, will fix issues raised during last call,
  will submit with base spec. Sam  Hartman will send a summary of the
  last call to the working group after reviewing with the editor. 

3.  Plain/saslprep

  The main issue is the stringprep profile. More review is required,
  especially of the profile.

  Issue: SASLprep profile should deal with user@domain-name syntax
  issues.  IN particular many authentication identifiers and
  authorization  identifiers include domain components. We need to be
  aware of any differences between nameprep and saslprep and  avoid
  introducing these differences without good reason.  Nameprep works on
  domain labels, while saslprep works on the string as a whole.
  Applications may mistakenly perform nameprep on input before giving
  it to SASL.

  Issue: Want SASLprep and Kerberos prep to use the same namespace.

  Discussion of authorization  names vs authentication names.  Larry
  Greenfield believes that applications will use the same profile for
  both.  Kurt pointed out that  LDAP is an example of an application
  with significantly different requirements for authorization
  identifiers than authentication identifiers.

3. DIGEST-MD5 issues  Alexey is editor
  draft-ietf-sasl-rfc2831bis
  three open issues:
  1. Whether we want to merge AES cipher?
     Postpone selection of mandatory-to-implement and adding AES
     until we have done a security analysis.  Security analysis will
  be posted to the working group list.
  2. Add SASLprep.
  3. then ready for last call.

4. CRAM-MD5 draft   Lyndon is editor
  1. add SASLprep, then done.

5. GSSAPI issues    
  1. Last call the base32 draft, then last call.
  2. An editor needs to be selected.

6. Individual submissions
  Authors of SRP document want to last call it.
    Issue: Sam Hartman believes it should have structure which
  included an OID in front so it could be used as a GSSAPI mechanism.