Subject: SASL applicability statement

From: Sam Hartman <[email-masked]>
Date: Wed, 19 Mar 2003 17:52:47 -0500

At this week's security directorate meeting, we discussed the need for
applicability statements for security protocols that both describe how
they should be used in another protocol and when they are appropriate.
Such a statement is being developed for TLS.

Some people felt that SASL didn't need such a statement because it was
sufficiently well understood by the applications area that nothing
needed to be said.  I and some others at the lunch disagreed and
believe that SASL tends to be misused in new protocols that try and
adopt it just like other security technologies.  The reason this tends
not to be a problem is that several people do a good job of looking at
SASL usage and fixing problems that we discover.

Do people believe such an applicability statement is useful?  Would
someone volunteer to be an editor?

Steve indicated that asking for this work to be added to our charter
would be a reasonable thing to do.

--Sam

---

From: Lawrence Greenfield <[email-masked]>
Date: Wed, 19 Mar 2003 19:55:50 -0800

> someone volunteer to be an editor?

It would be useful to have such a statement at times, especially since SASL 
tends to be underutilized in protocols that could easily make use of it 
without making any or little over-the-wire changes to them. There are still 
generic authentication frameworks being developed in protocol specific 
contexts (iSCSI, some proposals for IPsec). It would be nice if these 
attempts could instead be guided to strongly considering SASL.

But it's not clear to me that (for instance) TLS and SASL should be 
discussed in separate documents.

I think the document would be more useful for non-application area 
protocols, since the application area has (generally) become much more 
standardized on TLS and SASL usage.

Larry

---

From: Sam Hartman <[email-masked]>
Date: Wed, 19 Mar 2003 23:16:36 -0500

I think the document should discuss both TLS and SASL, but should
refer to a TLS applicability statement being written elsewhere for
specific TLS issues.  I suspect politically completely combining the
documents will be challenging.

---

From: Lawrence Greenfield <[email-masked]>
Date: Wed, 19 Mar 2003 19:55:50 -0800

Larry

---

From: Sam Hartman <[email-masked]>
Date: Wed, 19 Mar 2003 23:16:36 -0500