Subject: GS2: always use header compression?

From: Simon Josefsson <[email-masked]>
Date: Tue, 14 Apr 2009 11:40:40 +0200

Thinking about implementing GS2, handling the gs2-std-mech ("F") flag
seems complicated.  Is there any reason why GS2 cannot always require
clients to remove the header and servers to add it?

I believe this would lead to more robust code paths in implementations
(i.e., removing and adding the token is always done).  It also reduces
protocol complexity in that there are fewer ways GS2 can be negotiated.
This reduces the number of protocol variations that can be deployed,
which likely leads to better interoperability.

Thus I propose to remove the gs2-std-mech "F" flag and update the text
to require clients/server to always perform this step.  SCRAM doesn't
need any update, -12 doesn't seem to send a "F" at all and doesn't
discuss it.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 14 Apr 2009 11:57:49 +0200

Never mind, I had misunderstood the purpose of the "F" flag.

I have tried to clarify the document to possibly avoid others from
having the same misunderstanding.  New document:
http://josefsson.org/sasl-gs2/draft-ietf-sasl-gs2.txt
Diff against last version:
http://josefsson.org/sasl-gs2/draft-ietf-sasl-gs2-from--11.diff.html

I'll wait some days for the current discussions to settle down and then
submit an update.

/Simon