Subject: OTP and C API

From: Ken Murchison <[email-masked]>
Date: Thu, 08 Nov 2001 14:51:12 -0500

Folks,

This is kind of a hybrid specification/API/implementation question, but
I think it is fair game for this list.

I'm in the process of implementing OTP support in CMU SASL.  RFC2444
states:

"Clients SHOULD support display of the OTP challenge to the user and
entry of an OTP in multi-word format.  Clients MAY also support direct
entry of the pass phrase and compute the "hex" or "word" response."

Rob Siemborski (CMU SASLv2 implementor) and I decided upon the following
design in the client-side of the SASL library for supporting both of
these options:

- If the application provides an _optional_ SASL_CB_ECHOPROMPT callback,
use this to display the server challenge and accept the one-time
password.

- Otherwise, use the _required_ SASL_CB_PASS callback to accept the
secret pass-phrase and generate the correct response internally.

My questions are these:

Is this a valid use of a sasl_chalprompt_t as described in the C API?

If so, what is the difference between SASL_CB_ECHOPROMPT and
SASL_CB_NOECHOPROMPT?  Does the latter mean that the challenge and/or
prompt and/or response is should not echoed?

What is the purpose of the undocumented 'prompt' and 'defresult' params
in sasl_chalprompt_t?  Are these just leftover foo that were never
cleaned up?

Thanks,
Ken
-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp