Subject: Re: IETF70 SASL summary

From: Tom Yu <[email-masked]>
Date: Thu, 03 Jan 2008 18:41:14 -0500

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

Simon> Tom Yu <[email-masked]> writes:
>> Simon Josefsson has indicated he is not interested in purusing his
>> password-based mech draft at this time

Simon> Just to clarify: I will pursue the draft (implementing it now, the draft
Simon> will change a lot), but due to lack of interest (I haven't seen any
Simon> feedback), it won't include the SASL/GS2 mappings.  The document will be
Simon> a strict password-based GSS-API mechanism.

Do you intend for the SASL WG to continue considering this document,
or are you going to pursue it in Kitten rather than in SASL?  Also, I
believe that during SASL charter discussion, we had agreement that the
WG will attempt to produce a password-based mechanism that is a valid
GS2 mechanism, so there is interest in a mechanism that is valid both
as a GSS-API mechanism and as a SASL mechanism.

If you do intend for it to continue to be considered within SASL, I
would like to make sure that people have adequately considered it in
the context of our password-based mech charter goal.

---Tom

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 19 Jan 2008 15:39:53 +0100

> the context of our password-based mech charter goal.

I did intend for my proposal to be considered by the SASL WG, see:

http://article.gmane.org/gmane.ietf.kitten/1291

Whether the work is actually done in the SASL WG, the Kitten WG, or
elsewhere, seems less important to me.  Alas, I haven't had much time to
improve the document since my initial post of it, though.

What I need is a secure GSS-API mechanism for password authentication;
using it under GS2 was a secondary goal.

I may have missed them, but are there any other concrete proposals for
password based GSS-API mechanisms?

/Simon