Subject: [http-auth] Comments on draft-ietf-httpauth-scram-auth-00.txt

From: Michael Sweet <[email-masked]>
Date: Tue, 02 Jul 2013 07:58:18 -0400

All,

Some quick comments on draft-ietf-httpauth-scram-auth-00:

- Section 3: Would it make sense to reference RFC 5198 (Network Unicode) instead of/in addition to RFC 3629 (UTF-8) for the username and password? Beyond that, do you want to say something about "control" characters - in my experience that has been a major issue for interoperability.

- Section 4:
  - Given the vulnerabilities in SHA-1 and the requirements of the current HTTP Digest update draft (draft-ietf-httpauth-digest-update-02), would it make more sense to set the low bar at SHA2-256?
  - The uppercasing of the name makes sense for normalization, however the ABNF here and in RFC 2617 make the auth-scheme case-insensitive.

- Section 5:
  - (Editorial) Don't think you need the parens around '(and "sid")'.
  - The example shows the use of the Authentication-Info header, however RFC 2617's definition of the header does not allow for extension and has a slightly different format (no leading auth-scheme). Since an update is being done to Digest, this might be a chance to formalize the syntax to allow for extensibility with a leading auth-scheme followed by 0 or more auth-param values.
  - You probably want to include a info-scram ABNF rule with the challenge-scram and credentials-scram rules

- Section 5.1: I'm uncomfortable with including an attribute whose presence causes an error. Understanding you might want to extend things in the future, shouldn't those extensions define the attribute and its absence (when used with those extensions) cause an error?

- Section 6: Shouldn't the challenge-scram, credentials-scram, and info-scram rules be included here?

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair