Subject: [sasl] Clarification on the use of e= in SCRAM SASL/GS2

From: Alexey Melnikov <[email-masked]>
Date: Mon, 19 Apr 2010 14:34:08 +0100

The following 2 changes were initiated by Chris Newman during AUTH48 on 
SCRAM. I believe they are clarifications and I also believe that authors 
+ Simon Josefsson and Dave Cridland reached agreement on them. If you 
disagree with these changes, please shout now.

===
ADD another bullet point to the end of section 5.1:

o  e: This attribute specifies an error that occurred during authentication
     exchange. It is sent by the server in its final message and can help
     diagnose the reason for the authentication exchange failure.
     On failed authentication, the entire server-final-message
     is OPTIONAL; specifically, a server implementation
     MAY conclude the SASL exchange with a failure without sending the
     server-final-message. This results in an application-level error 
response
     without an extra round-trip. If the server-final-message is sent on
     authentication failure, then the "e" attribute MUST be included.

In Section 7:

OLD:
  server-final-message = (server-error / verifier)
                    ["," extensions]
                    ;; The error message is only for the GSS-API
                    ;; form of SCRAM, and it is OPTIONAL to
                    ;; implement it.

NEW:
  server-final-message = (server-error / verifier)
                    ["," extensions]

---

From: Paul Aurich <[email-masked]>
Date: Wed, 28 Apr 2010 20:45:36 -0700

> disagree with these changes, please shout now.

I have no problem with the changes, but in looking at the ABNF value of the
error, I'm confused by the meaning of the
"server-does-support-channel-binding" error:
                  "server-does-support-channel-binding" /
                    ; server does not support channel binding
                  "channel-binding-not-supported" /

In what case is this used, and are the text value/comment in conflict or is
there something I'm missing?  (Should the comment come after the
channel-binding-not-supported value, perhaps?)

Thanks,
~Paul