Subject: Fwd: Re: draft-ietf-sasl-rfc2222bis-02 comments

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 01 Nov 2003 08:17:41 -0800

>Date: Sat, 01 Nov 2003 15:33:40 +0000
>From: Alexey Melnikov <[email-masked]>
>To: Hallvard B Furuseth <[email-masked]>
>CC: "Kurt D. Zeilenga" <[email-masked]>, [email-masked]
>Subject: Re: draft-ietf-sasl-rfc2222bis-02 comments
>List-Archive: <http://www.imc.org/ietf-sasl/mail-archive/>
>
>
>Hallvard B Furuseth wrote:
>>>>>We should not suggest that mechanisms should do both (1) and
>>>>>(2).  (1) and (3) OR (2) or (3) are sufficient to ensure
>>>>>proper matching.
>>>>>       
>>>>IMHO, this is a responsibility of the client,
>>>>     
>>
>>Disagree.  It's the responsibility of the mechanism definition to say
>>where it should happen.
>Ok.
>But in all SASL mechanisms I know the client end sends username or retrieves-hashes-sends something derived from a password.
>So, so far this is the same thing ;-).

There are certainly mechanisms which don't transfer a username (authentication
identity in simple form) and/or don't transfer a value derived from a simple
password.  (For example, EXTERNAL.)  And for those which do, it should be left
up to the mechanism to state where preparation of those strings is to be done.

The framework specification should avoid getting details which are mechanism-specific.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 01 Nov 2003 08:17:41 -0800

Kurt