Subject: SRP SASL draft

From: Keith Burdis <[email-masked]>
Date: Sun, 11 Feb 2001 22:19:11 +0200

Hi there

Time for something on this list other than SPAM :-)

As some of you may have noticed a new version of the SRP SASL mechanism draft
is out:

  draft-burdis-cat-srp-sasl-04.txt

The most important thing about this draft is that I now have a co-author (Raif
Naffah from Down Under) and the draft is the better for it. In particular,
Raif should get credit for improvements in the mechanism element encodings and
in how the security layer works, as well as many of the changes below.

Here are some of the changes:

 - Describes a family of SASL mechanisms based on SRP. Each actual mechanism
   can use a different underlying one-way function. Previously only SRP-SHA1
   was supported.

 - Dropped the use of Netstrings in favour of encodings that prepend the
   length of the following field using a fixed number of bytes.

 - Changed the authentication protocol so that the client sends its username
   as the first message in the protocol exchange. This allows the server to
   have a different exponent and generator for each client. The cost of the
   extra message can be eliminated by having the client send it as part of its
   initial response.

 - Changed the mandatory confidentiality algorithm (when confidentiality
   protection is supported) from Blowfish to AES (Rijndael). Designated that
   block ciphers should use OFB (Output Feedback Block) mode with PKCS #7
   padding.

 - The security layer is now much more clearly explained as a three-stage
   filter consisting of the confidentiality protection, replay detection and
   integrity protection stages, which may be inactive. 

Raif and I have also released a new version of the Cryptix SASL library that
implements the Java SASL bindings and some SASL mechanisms, including this
one.

  http://www.cryptix.org/~keith/0_8_5/

We'd appreciate any comments, criticism, or suggestions any of you might have.

Thanks.

 - Keith

PS: Sorry Paul, I haven't got any further with the Digest implementation :(

--
Keith Burdis - MSc (Computer Science) - Rhodes University, South Africa
IRC: Panthras					JAPH 	QEFH
---