Subject: SASL working group summary for IETF 60

From: Sam Hartman <[email-masked]>
Date: Wed, 04 Aug 2004 17:35:06 -0400

The SASL working group met for one hour.  The SASL base spec
(draft-ietf-sasl-rfc2222bis) is in last call.  We need more review of
this document; without this review the chairs will be unable to
recommend the document for publication.  Nicolas Williams will provide
security considerations text for rekeying to be considered by the group.

Not much progress has been made on digest-md5 since the last IETF.
The explicit IV issues for CBC have been discussed but are still open.
The character set conversion issues are still open although there is
still a possibility we will be able to move exclusively to UTF8.  At
least two more revisions of the draft are expected.

There was discussion of the GSSAPI mechanism.  everyone agrees we need
to maintain compatibility with the widely deployed Kerberos 5
mechanism.  Sam Hartman proposed significant changes to other GSSAPI
SASL mechanisms for improved efficiency.  One reason we may want this
change is HTTP SASL.  Discussion will continue on the list.

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 05 Aug 2004 00:07:38 +0200

> change is HTTP SASL.  Discussion will continue on the list.

How about forking the GSSAPI document into one Kerberos 5 "GSSAPI"
document, and one document for the generic "GSS-*" mechanism set?  If
the protocol for "GSS-*" will be different from the "GSSAPI" protocol,
perhaps it doesn't make sense to describe both in the same document.
It might also help focus on making the "GSS-*" protocol better,
without having to pay attention to Kerberos 5 specific issues.

Regards,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 11 Aug 2004 15:07:09 +0100

>without having to pay attention to Kerberos 5 specific issues.
This is pretty much what I've suggested.

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 05 Aug 2004 00:07:38 +0200

Regards,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 11 Aug 2004 15:07:09 +0100