Subject: [sasl] Implementing SCRAM

From: Simon Josefsson <[email-masked]>
Date: Tue, 08 Sep 2009 19:12:33 +0200

I started to implement SCRAM.  As far as I can tell, the document does
not say which ABNF constructions correspond to which messages that the
client/server sends and in which order.  If I have missed it, please
point to the section that describes this.

I know we are past WGLC, but I hope these comments are useful anyway.  I
believe they are non-controversial but important.

In section 5 the changes below would improve the document:

OLD:
   First, the client sends a message containing:

NEW:
   First, the client sends the "client-first-message" containing:

Reading the rest of that section, I think it would help to make these
changes as well:

OLD:
   In response, the server sends the user's iteration count i, the
   user's salt, and appends its own nonce to the client-specified one.

NEW:
   In response, the server sends a "server-first-message" containing the
   user's iteration count i, the user's salt, and appends its own nonce
   to the client-specified one.

I would add whitespace to split the paragraph at this point.

Then I suggest this change:

OLD:
   The client then responds with the same nonce and a ClientProof
   computed using the selected hash function as explained earlier.

NEW:
   The client then responds by sending "client-final-message" with the
   same nonce and a ClientProof computed using the selected hash
   function as explained earlier.

Again, I would add whitespace at this point.

OLD:
   The server verifies the nonce and the proof, verifies that the
   authorization identity (if supplied by the client in the first
   message) is authorized to act as the authentication identity, and,
   finally, it responds with a ServerSignature, concluding the
   authentication exchange.

NEW:
   The server verifies the nonce and the proof, verifies that the
   authorization identity (if supplied by the client in the first
   message) is authorized to act as the authentication identity, and,
   finally, it responds with a "server-final-message", concluding the
   authentication exchange.

I.e., just change "ServerSignature" to "server-final-message".

Again, at this point I would add whitespace to separate the paragraph.

I hope this is the only clarification needed. :-)

/Simon

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 8 Sep 2009 12:19:36 -0500

> believe they are non-controversial but important.

These changes are non-controversial, and can be applied either when an
update is required during IESG review, if any, or in a note to the
RFC-Editor when the I-D is approved for publication.

Nico
--

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 09 Sep 2009 12:45:57 +0200

Alexey Melnikov <[email-masked]> writes:

>>>I am still waiting for the updated GS2, as this will be blocking SCRAM
>>>publication.
>>>When do you think you can post a new version?
>>>    
>>>
>>Sorry, I have lost track of this -- I didn't know we had reached closure
>>on the remaining issue.  The changes I have locally are:
>>
>>http://josefsson.org/sasl-gs2/draft-ietf-sasl-gs2-from--16.diff.html
>>
>>What other changes are needed?  I recall discussions around IANA section
>>but don't recall any conclusion, but I may have missed it.
>>  
>>
> I think no other changes needed, as we haven't reached a decision to
> change anything.
> So just post what you have.

Done!

Wg, the -17 only contains the changes we agreed to put it based on last
discussion.  I believe there may be other changes needed in the IANA
section, but I'll wait for WG Chairs or AD input on what should actually
be in the document.

/Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 09 Sep 2009 21:29:45 +0100

Thank you Simon,
I've applied all of your suggested changes.

>   First, the client sends the "client-first-message" containing:
Changed.

>   to the client-specified one.
Changed.

>I would add whitespace to split the paragraph at this point.
Added.

>   function as explained earlier.
Changed.

>Again, I would add whitespace at this point.
Added.

>I.e., just change "ServerSignature" to "server-final-message".
Changed.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 09 Sep 2009 22:08:40 +0100

Thank you Simon,

Changed.

Changed.

Added.

Changed.

Added.

Changed.