Subject: draft-burdis-cat-srp-sasl-07.txt

From: "Trevor Perrin" <[email-masked]>
Date: Fri, 13 Sep 2002 15:54:02 -0800

Hi Keith and Raif,

couple comments on this draft.  From RFC 2945:
   The client MUST abort authentication if B % N is zero.
   The host MUST abort the authentication attempt if A % N is zero.

These checks are extremely important (see the "Constraint checks" section of 
Tom Wu's SRP paper).  You should mention them in your draft, and give them 
some emphasis, cause this is a likely thing for implementors to omit.

Also, the Introduction says that this draft is based on the optimized SRP 
protocol from RFC 2945, but it isn't, that statement is probably just left 
over from a previous draft and should be struck.

Trevor

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com