Subject: Re: rfc2831bis issues

From: Alexey Melnikov <[email-masked]>
Date: Sat, 01 Nov 2003 15:09:20 +0000

Hallvard B Furuseth wrote:

>Alexey Melnikov writes:
>  
>
>>>>2.1.1  Step One
>>>>
>>>>  The server starts by sending a challenge.
>>>>        
>>>>
>>>How does it know that it should do that?      
>>>
>>The client always starts first (according to SASL). If the client 
>>doesn't includes an initial response, the server will know.
>>
>>Can you suggest any clarification text here?
>>    
>>
>
>'The server starts by sending a challenge after the client indicates
>that SASL negotiatin should start'?
>  
>
SASL framework doesn't support the case when the server initiate 
authentication exchange.
The only way to do that is for the server to return some kind of 
"authentication required" error code when the client tries to issue 
other commands.

> ...
>
>>>>2.2  Subsequent Authentication
>>>>
>>>>  If the client has previously authenticated to the server, and
>>>>  remembers the values of username, realm, nonce, nonce-count, cnonce,
>>>>        
>>>>
>>>                           ^^^^^^^^
>>>      
>>>
>>>>  and qop that it used in that authentication, and the SASL profile for
>>>>  a protocol permits an initial client response, then it MAY perform
>>>>  "subsequent authentication", as defined in this section.
>>>>        
>>>>
>>>What's the point of authenticating again with the same username?  Auth
>>>with a _different_ username would be more interesting.
>>>      
>>>
>>This is a case of fast reauthentication using a different TCP 
>>connection. This is similar to resuming a TLS session.    
>>
>
>Oh.  Could you add 'even after closing the connection and reopening a
>new one' in section 2.2?
>  
>
Actually, this can be done on the same connection, if the protocol 
supports reauthentication.

I've added the following:
Note, that a subsequent authentication can be done on a different 
connection, or on the same connection, if the protocol profile also
permits multiple authentications.

I've also added some clarification text at the beginning of section 2.

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 4 Nov 2003 22:16:11 +0100

Alexey Melnikov writes:
>>draft-ietf-sasl-rfc2831bis-02.txt:
>>>
>>>        ( *LWS element *( *LWS "," *LWS element ))
>>
>>Should this really be asymmetric, or should it be
>>          (      element *( *LWS "," *LWS element ))
>>or
>>          ( *LWS element *( *LWS "," *LWS element ) *LWS )
>>
>I can go for the last proposal. At least it seems to be the original intent.

I just realized that this was copied from rfc2616.  So it's probably
better to leave it alone for compatibility's sake, or ask rfc2616's
author.

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 05 Nov 2003 10:30:24 +0000

Hallvard B Furuseth wrote:

>I just realized that this was copied from rfc2616.
>
Correct.

>So it's probably
I've already fixed several minor ABNF bugs. But it would be a good idea 
to keep DIGEST-MD5 and RFC 2616 in sync.

Alexey
__________________________________________

Isode Limited, http://www.isode.com

IETF standard related pages:
http://www.melnikov.ca/mel/devel/Links.html
__________________________________________

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 01 Nov 2003 15:09:20 +0000

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 4 Nov 2003 22:16:11 +0100

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 05 Nov 2003 10:30:24 +0000

Correct.

Alexey