Subject: Mark Crispin's comments on draft-ietf-sasl-plain-03.txt

From: Rob Siemborski <[email-masked]>
Date: Wed, 29 Oct 2003 19:05:11 -0500 (EST)

Mark had a few comments on the PLAIN draft, mostly centered around the
issue of the initial response examples.  I tend to agree with his
assessments.  I'll note (as Kurt did), that this document has already been
through the WG last call.

a) ACAP is probably not the best choice of protocol for the example, since
it is not in wide use.  A protocol such as SMTP is probably more
appropriate (especially given the trouble we've seen with SMTP
implementations getting initial response handling correct).  SMTP has the
added advantage of having 3 digit response codes that in other have
optional text -- though that is not the case in the SASL challenges.

b) An example demonstrating plain without using the initial response
argument on a protocol that supports it.  This would again help to address
the implementation problems with the optional initial client send.

There are examples in draft-siemborski-rfc2554bis-00.txt (using SMTP) that
satisfy this, and could be used.

One thing that may also help is to place reminders in mechanism (and
protocol) documents that a correct implementation of SASL for a given
protocol requires an understanding of the protocol profile, the SASL
framework, and the mechanism, and that reading all three documents is
necessary to get it right.  Of course, in a perfect world, normative
references would be enough, but experience seems to be showing this not to
be the case.

(I'd also like to encourage people again to read over and comment more
generally on draft-siemborski-rfc2554bis-00.txt and
draft-siemborski-rfc1734bis-00.txt).

We're also both planning on being at the SASL WG meeting in Minneapolis,
and can discuss this further then.

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski | Andrew Systems Group * Research Systems Programmer
PGP:0x5CE32FCC | Cyert Hall 207 * [email-masked] * 412.268.7456
-----BEGIN GEEK CODE BLOCK----
Version: 3.12
GCS/IT/CM/PA d- s+: a-- C++++$ ULS++++$ P+++$ L+++(++++) E W+ N o? K-
w O- M-- V-- PS+ PE++ Y+ PGP+ t+@ 5+++ R@ tv-@ b+ DI+++ G e++ h r- y?
------END GEEK CODE BLOCK-----