Subject: [sasl] Importance of exact Authentication Information to ensure reaching design goals

From: Tobias Markmann <[email-masked]>
Date: Tue, 8 Jun 2010 21:36:32 +0200

Hi,

would it still be possible to add/change a little text in SCRAM? I think there should be more emphasis on the fact that if you don't store the information described as authentication information you'll loose one of the major design goal, being point 3, "The authentication information stored in the authentication database is not sufficient by itself to impersonate the client.". Sure this seems obvious if you read it from top to end but I've still the impression that the authentication particulars for the client are described more clearly.

Cheers,
Tobias

--
Tobias Markmann
http://ayena.de

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 8 Jun 2010 14:38:15 -0500

On Tue, Jun 08, 2010 at 09:36:32PM +0200, Tobias Markmann wrote:
> would it still be possible to add/change a little text in SCRAM? I
> think there should be more emphasis on the fact that if you don't
> store the information described as authentication information you'll
> loose one of the major design goal, being point 3, "The authentication
> information stored in the authentication database is not sufficient by
> itself to impersonate the client.". Sure this seems obvious if you
> read it from top to end but I've still the impression that the
> authentication particulars for the client are described more clearly.

Propose text.  We're still in AUTH48.