Subject: OTP and C API

From: Ken Murchison <[email-masked]>
Date: Thu, 08 Nov 2001 14:51:12 -0500

Folks,

This is kind of a hybrid specification/API/implementation question, but
I think it is fair game for this list.

I'm in the process of implementing OTP support in CMU SASL.  RFC2444
states:

"Clients SHOULD support display of the OTP challenge to the user and
entry of an OTP in multi-word format.  Clients MAY also support direct
entry of the pass phrase and compute the "hex" or "word" response."

Rob Siemborski (CMU SASLv2 implementor) and I decided upon the following
design in the client-side of the SASL library for supporting both of
these options:

- If the application provides an _optional_ SASL_CB_ECHOPROMPT callback,
use this to display the server challenge and accept the one-time
password.

- Otherwise, use the _required_ SASL_CB_PASS callback to accept the
secret pass-phrase and generate the correct response internally.

My questions are these:

Is this a valid use of a sasl_chalprompt_t as described in the C API?

If so, what is the difference between SASL_CB_ECHOPROMPT and
SASL_CB_NOECHOPROMPT?  Does the latter mean that the challenge and/or
prompt and/or response is should not echoed?

What is the purpose of the undocumented 'prompt' and 'defresult' params
in sasl_chalprompt_t?  Are these just leftover foo that were never
cleaned up?

Thanks,
Ken
-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Chris Newman <[email-masked]>
Date: Thu, 08 Nov 2001 14:01:18 -0800

> Is this a valid use of a sasl_chalprompt_t as described in the C API?

Yes, that's what it was intended for.

> prompt and/or response is should not echoed?

Correct.

> in sasl_chalprompt_t?  Are these just leftover foo that were never

It works like this:

      Challenge

prompt: ______________
           defresult

Challenge is displayed up front.  Prompt appears before the user input 
field, and defresult is what goes in the user input field if the user just 
hits return with no input.

		- Chris

---

From: Ken Murchison <[email-masked]>
Date: Fri, 09 Nov 2001 08:58:20 -0500

> Yes, that's what it was intended for.

Great.

> > prompt and/or response is should not echoed?

So _none_ of this info should be echoed?  Can you give me an example of
when NOECHOPROMPT would be used?  Do you agree that ECHOPROMPT is the
correct callback for a OTP implementation?

> hits return with no input.

Aren't the prompt and defresult taken care of by sasl_interact_t?  Why
are they present in this callback, but not in sasl_getsimple_t or
sasl_getsecret_t?

Thanks,
Ken

---

From: Chris Newman <[email-masked]>
Date: Fri, 09 Nov 2001 10:57:38 -0800

> correct callback for a OTP implementation?

NOECHOPROMPT means don't display what the user types (e.g. as with a 
regular password).  ECHOPROMPT means display what the user typed. 
ECHOPROMPT should be used with one-time passwords.

> Aren't the prompt and defresult taken care of by sasl_interact_t?

What do you mean by taken care of?  The API supports two approaches to 
getting data from the user, one returns with an error and you have to fill 
in sasl_interact_t (useful for event-driven programming), the other is 
callback based (simpler for threaded programming).  They need to have 
equivalent parameters.

> Why

Becuase getsimple/getsecret are simpler calls.  Make the common case 
simple, make the uncommon case possible.

		- Chris

---

From: Chris Newman <[email-masked]>
Date: Thu, 08 Nov 2001 14:01:18 -0800

Correct.

It works like this:

      Challenge

prompt: ______________
           defresult

		- Chris

---

From: Ken Murchison <[email-masked]>
Date: Fri, 09 Nov 2001 08:58:20 -0500

Great.

Thanks,
Ken

---

From: Chris Newman <[email-masked]>
Date: Fri, 09 Nov 2001 10:57:38 -0800

- Chris