Subject: Comments on YAP

From: Nicolas Williams <[email-masked]>
Date: Mon, 18 Feb 2008 02:10:53 -0600

I believe YAP should share as much as possible with SCRAM, including key
hierarchy and message formats, but it should still be a distinct
mechanism.

YAP should differ from SCRAM only in that the client does not request a
challenge and the server does not furnish it.  Instead unique channel
bindings are required and are used as the ServerNonce, and no
ClientNonce is used.

YAP should be usable in place of SCRAM when the client has "recently"
authenticated to the same server using SCRAM.  This is needed so that
the client can know the salt, iteration count, ...

I.e., YAP should be, essentially, a round-trip optimized version of
SCRAM but with limited applicability.

Nico
--