Subject: Re: SRP and SM2

From: Alexey Melnikov <[email-masked]>
Date: Tue, 01 May 2001 23:08:54 -0600

Paul Leach wrote:

> >
> > As noted in section 7.4 of the SM2 draft, the "subsequent
> > authentication" described in RFC 2831 maps nicely on to the
> > SM2 exchange.  I suggest removing section 2.2 of RFC 2831 in
> > favour of SM2.
>
> Since there are many existing implementations of RFC 2831,

IMHO, the right question to ask is "how many existing implementations of RFC
2831 support reauthentication"? CMU implementation does not. Anybody
supports DIGEST-MD5 reauthentication?

> why not rewrite SM2 to reuse the fast reconnect mechanism of RFC 2831
> instead of
> telling everyone to drop it and switch to a different mechanism.

As I understand SM2 after reading the document, it is a kind of
"reauthentication framework", higher level SASL mechanism designed to be
used together with other SASL mechanisms (hopefully what I wrote has any
sense in English :-)).

> I think there should be compelling technical reasons to intruduce a
> change. 2831 in its current form is a mandatory to implement mechanism
> for LDAP, for example.

If there are no two independent interoperable client/server side
implementations, DIGEST-MD5 can't progress to Draft Standard. If we decide
to move this functionality to SM2, reauthentication will not delay the
advancement of DIGEST and can be done separately.

> Paul

__________________________________________
Alexey Melnikov - Software Developer
Research and Development
ACI Worldwide (formerly MessagingDirect Ltd.)
phone           780.424.4922 x357
__________________________________________
I don't represent the opinion of TSA/ACI!
__________________________________________

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 01 May 2001 23:08:54 -0600