Subject: [Crisp] Re: Last Call Comments on XPC

From: Marcos Sanz/Denic <[email-masked]>
Date: Thu, 24 Aug 2006 11:41:17 +0200

Hi Sam,

> First, you don't specify enough about SASL for an interoperable
> implementation.  PLease see the application protocol requirements in
> RFC 4222 for what you need to specify.  My preference is that you
> reference RFC 4222 not 2222.

Ok, first of all I am not the author of the draft, it's Andy. But anyway 
I'll take a look at 4422 (it's pretty new) and review XPC with that new 
light.

> The SASL tokens can be rather large--several kb in some common
> situations.  So I'm not sure that the requirement they fit in a single
> chunk is reasonable.

We have up to 64 Kb for a single SASL token (minus 4 bytes up to minus 23 
bytes, depending on the mechanism name length). Do you think that's a real 
problem?

Best regards,
Marcos

_______________________________________________
Crisp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/crisp

---

From: Andrew Newton <[email-masked]>
Date: Thu, 24 Aug 2006 11:44:21 -0400

> I'll take a look at 4422 (it's pretty new) and review XPC with that new 

OH! 4422! I starting reading a BCP on OSPF and couldn't figure out what it 
had to do with this.

First, I sent email to one of the authors of 4422 last year asking for 
review, and got an "I'm busy" response.  Though he did say he thought we 
were on the right track.

I've looked at 4422, and have identified several areas where XPC needs 
either better documentation or revision.  However, I'd appreciate more than 
just a vague, "you need to do more".  After all, there's a good chance I 
might miss something in those 33 pages.

That being said, I do have a couple of very specific questions:

1) I understand what the Authorization Identity String (Section 3.4.1) is, 
I'm just unsure where it is to be used.  I was under the impression that 
where it is to be used was specific to each SASL mechanism.

2) Section 3.4 notes that one of the purposes of the challenges and response 
is "authenticate the server to the client".  Does a client have to request 
this authentication?  It isn't clear to me that I need to specific protocol 
interactions for this particular use case or if that is covered in the 
general requirements for a protocol (as listed in Section 4).

3) Section 4, number 1 says that a "service" name must be specified.  I 
didn't readily understand in which protocol operation it is to be specified. 
  Also, would this be different than the identifier we have already picked 
to identify the protocol in the version information: iris.xpc1.

-andy

---

From: Andrew Newton <[email-masked]>
Date: Tue, 29 Aug 2006 10:50:54 -0400

Sam,

Thanks very much for the clarifications.  It was very helpful.

I'll make the appropriate changes.

-andy