Subject: Re: WG Last Call: draft-ietf-sasl-scram-01.txt

From: Alexey Melnikov <[email-masked]>
Date: Wed, 08 Jul 2009 12:22:57 +0100

Nicolas Williams wrote:
 [...]

>My only comments are editorial, otherwise I'm happy with this
>Internet-Draft:
>
> - Clarify this sentence:
>
>  "This means that SCRAM is actually both, a GSS-API and SASL mechanism."
>
>   as follows:
>
>  "This means that this document defines both, a GSS-API mechanism and a
>   SASL mechanism."
>
>   Rationale: one must remove the GS2 header from the initial context
>   token and then add the RFC2743 initial context token header in order
>   to get SCRAM as a GSS-API mechanism, therefore the original text
>   above might be confusing to some readers.  See section 8.
>
> - Section 4, there's a typo: (20-length("SCRAM-")-lenght("-PLUS")
>   (the second 'length' is misspelled).
>
> - Section 5, "SCRAM is a text protocol where...".  Really?  I thought
>   SCRAM was a mechanism, not a protocol...  How about:
>
>   "SCRAM is a SASL mechanism whose authentication messages are
>   text-based messages containing one or more attribute-value pairs
>   separated by commas."
>
>   (That these messages are exchanged by a client and server seems
>   superfluous once one describes SCRAM as a SASL mechanism.)
>
> - Section 6:
>
>"
>   o  If the client negotiates mechanisms then client MUST select SCRAM-
>      <hash-function>-PLUS if offered by the server.  Otherwise, if the
>      client does not negotiate mechanisms then it MUST select only
>      SCRAM-<hash-function> (not suffixed with "-PLUS").
>"
>
>   s/then client/then the client/
>
>   s/MUST select SCRAM-<hash-function>-PLUS if offered by the server/
>     MUST select SCRAM-<hash-function>-PLUS if offered by the server and
>     the client wants to select SCRAM with the given hash function/
>
> - Section 6:
>
>   o  If the client supports channel binding but the server does not
>      then the client MUST ...
>
>   s/the server does not/the server does not (i.e., did not offer
>     SCRAM-<hash-function>-PLUS) then the client MUST .../
>  
>
Nico,
I believe I've addressed all your comments in my copy.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 8 Jul 2009 10:50:02 -0500

> I believe I've addressed all your comments in my copy.

OK, thanks.  I'll review.