Subject: [http-auth] SCRAM updates

From: Alexey Melnikov <[email-masked]>
Date: Thu, 13 Nov 2014 00:46:17 +0000

Hi,
I submitted draft-ietf-httpauth-scram-auth-04 and 
draft-melnikov-httpbis-scram-auth-01. They are largely identical, the 
main difference between the two is that the latter is encapsulating 
SCRAM messages from RFC 5802 inside base64-encoded attribute called 
"data" (and is referencing RFC 5802 for SCRAM attribute definition), 
while the former is still trying to make each SCRAM attribute to be a 
proper HTTP SCRAM attribute. The advantage of the latter approach is 
that SCRAM implementations written for use in other application 
protocols can be used as-is in HTTP.

Let me know which version you prefer and I will post WG's -05 based on it.

Best Regards,
Alexey

---

From: Tony Hansen <[email-masked]>
Date: Wed, 12 Nov 2014 22:28:58 -0500

> Let me know which version you prefer and I will post WG's -05 based on 

I prefer the base64-encoded encapsulation, as in 
draft-melnikov-httpbis-scram-auth-01. I think that being able to reuse 
existing SCRAM libraries is important to interoperability.

     Tony Hansen