Subject: Summary of SASL Session at IETF 59

From: Sam Hartman <[email-masked]>
Date: Wed, 03 Mar 2004 02:46:54 -0500

The SASL working group met for an hour at IETF 59.  The primary
objective of the meeting was to determine next steps for RFC 2222bis.

The chairs are concerned that the document has not received sufficient
review.  The chairs will contact the apps and security areas and ask
for review of the specification before last call.

Kurt Zeilenga raised several issues on the mailing list.  Most of
these were resolved before the meeting; Kurt will check future
versions of the draft to confirm resolution.

One of Kurt's issues that is not resolved is the handling of security
layers for multiple reauthentications.  At IETF 58, we decided not to
change the protocol because of this threat, but Kurt raised concerns
about the wording of the security consideration.  During this
discussion Sam Hartman realized this attack is apparently an instance
of a more general attack.  Sam will confirm this and propose text on
the list.

Bob Morgan described his concerns about the confusion between
authentication identity and authorization ID.  The sense of the room
was that while we want to be as clear as possible, both concepts are
important and we need to keep both terms.  This discussion is still
open on the list.

A new document will be published  shortly after the meeting.  There
will be a need for at least one more revision, slated for early April
before a last call.  We hope to have the base spec to the IESG by
May; this is a milestone slip.

ALexey Melnikov still needs input on use of stringprep and saslprep in
digest-md5.  There was discussion of dropping support for ISO 8859-1
and claiming that all strings are UTF8.  This will be resolved on the
list.  

Sam agreed to review the  AES mode for digest-md5.  The
working group previously agreed to use explicit IVs to avoid chosen
ciphertext attacks, but ALexey has two alternative wire formats for
explicit IVs.

We hope to have digest-md5 last called by July.  Alexey thinks this is
very optimistic.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 03 Mar 2004 02:46:54 -0500