Subject: Extensibility of response-auth in DIGEST-MD5

From: Alexey Melnikov <[email-masked]>
Date: Mon, 06 Dec 2004 16:35:47 +0000

Simon has pointed out to me that both step 1 ("digest-challenge" 
non-terminal) and step 2 ("digest-response" non-terminal) of the 
DIGEST-MD5 (currently draft-ietf-sasl-rfc2831bis-04.txt) allow for 
"auth-param", which is described as:

   auth-param
      This construct allows for future extensions; it may appear more
      than once. The client MUST ignore any unrecognized directives.

However, the "response-auth" non-terminal used in step 3 doesn't allow 
for any extensibility.
Is there a good reason for that and does anybody mind if I add 
"auth-param" to the "response-auth"?

Alexey

---

From: Sam Hartman <[email-masked]>
Date: Tue, 07 Dec 2004 05:01:46 -0500

>>>>> "Alexey" == Alexey Melnikov <[email-masked]> writes:

    Alexey>    auth-param This construct allows for future extensions;
    Alexey> it may appear more than once. The client MUST ignore any
    Alexey> unrecognized directives.

    Alexey> However, the "response-auth" non-terminal used in step 3
    Alexey> doesn't allow for any extensibility.  Is there a good
    Alexey> reason for that and does anybody mind if I add
    Alexey> "auth-param" to the "response-auth"?
I don't object.  However it seems like you have extensions in both
directions and that is enough to negotiate support for a new feature.

--Sam

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 09 Dec 2004 04:51:10 +0100

> "auth-param" to the "response-auth"?

Perhaps I should mention the background for my question.

I'm writing a parser for the DIGEST-MD5 grammar.  The challenge and
response tokens are defined by ABNF using the '1#' construct, but the
finish step does not use '1#'.

That has consequences for how white space and empty fields are
handled.  For example, according to the ABNF, the challenge/response
tokens can validly start with:

  , , ,,,,

So my proposal would be to replace in section 2.1.3:

    response-auth = "rspauth" "=" response-value

with:

    finish = 1#( response-auth | auth-param )

    response-auth = "rspauth" "=" response-value

Further, I believe the following is unacceptable:

   Since it is cut-and-paste from the HTTP specifications, not all
   productions may be used in this specification. It is also not quite
   legal ABNF; again, the errors were copied from the HTTP
   specifications.

The intention of the document should be that the grammar is free of
errors.  I think that the known errors should be fixed, and ideally
also sent to the RFC editor as an errata to the HTTP specification.

Thanks,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 09 Dec 2004 12:40:34 +0000

>    finish = 1#( response-auth | auth-param )
I've changed "finish" to "auth-info", to be consistent with HTTP Digest 
(RFC 2617).

Looking at syntax in RFC 2617, your proposal is consistent with how RFC 
2617.

>   legal ABNF; again, the errors were copied from the HTTP
This is actually not true anymore. I've already fixed few things.

>also sent to the RFC editor as an errata to the HTTP specification.
Yes, I agree.

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 09 Dec 2004 23:59:33 +0100

> Looking at syntax in RFC 2617, your proposal is consistent with how RFC 

Ah, thanks, I didn't look in RFC 2617.  There should probably text
like the following for the response-auth field as well:

   This directive is required and MUST appear exactly once; if not
   present, or if multiple instances are present, the client SHOULD
   abort the authentication exchange.

> This is actually not true anymore. I've already fixed few things.

Excellent!  I'm extracting the ABNF grammar from the document, which
is used as input to the parser generator, so I'll be able to confirm
that the grammar is self contained.  (These tools are unfinished, so I
haven't run the complete current grammar through the tools yet.)

Thanks,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 10 Dec 2004 11:22:46 +0000

>   abort the authentication exchange.
Yes, I've already added something like this.

>>This is actually not true anymore. I've already fixed few things.
I've removed the second sentence.

>that the grammar is self contained.
>
Good.

>  (These tools are unfinished, so I

---

From: Sam Hartman <[email-masked]>
Date: Tue, 07 Dec 2004 05:01:46 -0500

--Sam

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 09 Dec 2004 04:51:10 +0100

, , ,,,,

with:

Thanks,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 09 Dec 2004 12:40:34 +0000

Yes, I agree.

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 09 Dec 2004 23:59:33 +0100

Thanks,
Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 10 Dec 2004 11:22:46 +0000

Good.