Subject: SASL applicability statement

From: Sam Hartman <[email-masked]>
Date: Wed, 19 Mar 2003 17:52:47 -0500

At this week's security directorate meeting, we discussed the need for
applicability statements for security protocols that both describe how
they should be used in another protocol and when they are appropriate.
Such a statement is being developed for TLS.

Some people felt that SASL didn't need such a statement because it was
sufficiently well understood by the applications area that nothing
needed to be said.  I and some others at the lunch disagreed and
believe that SASL tends to be misused in new protocols that try and
adopt it just like other security technologies.  The reason this tends
not to be a problem is that several people do a good job of looking at
SASL usage and fixing problems that we discover.

Do people believe such an applicability statement is useful?  Would
someone volunteer to be an editor?

Steve indicated that asking for this work to be added to our charter
would be a reasonable thing to do.

--Sam