Subject: Comments on draft-ietf-sasl-rfc2831

From: Sam Hartman <[email-masked]>
Date: Tue, 25 Mar 2003 09:40:45 -0500 (EST)

In section 2.1.1, the draft states:

       Note, that this directive doesn't affect authorization id
       ("authzid") which is always in UTF-8.

It is not the place of the mechanism spec to say anything about the
character set of the authorization ID; the mechanism should treat the
authorization ID as an opaque string and leave it up to the
application to specify the meaning of the authorization id.

In section 2.1.2.1, is exchange protected against a downgrade attack
from auth-conf, auth-int to auth?  I.E. Looking at the definition of
a2 and response, I see where the client value of qop is used, but not
the server supplied qop options.  The security discussion seems
inadequate.