From nobody Thu Apr 10 15:18:18 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAE011A0316 for ; Thu, 10 Apr 2014 15:18:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.348 X-Spam-Level: X-Spam-Status: No, score=0.348 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FLOkAZja7I5l for ; Thu, 10 Apr 2014 15:18:13 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) by ietfa.amsl.com (Postfix) with ESMTP id C16DC1A031E for ; Thu, 10 Apr 2014 15:18:12 -0700 (PDT) Received: from latte.josefsson.org (static-213-115-179-130.sme.bredbandsbolaget.se [213.115.179.130]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id s3AMI0WW021139 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Fri, 11 Apr 2014 00:18:02 +0200 Date: Fri, 11 Apr 2014 00:17:59 +0200 From: Simon Josefsson To: kitten@ietf.org Message-ID: <20140411001759.3d89cfb5@latte.josefsson.org> In-Reply-To: <20140312162849.152e924b@latte.josefsson.org> References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.98.1 at duva.sjd.se X-Virus-Status: Clean Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/FlLKEdTPusTaUuRPyJlWMYlIXBc Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Apr 2014 22:18:17 -0000 Hi again, I haven't seen anyone disagree with my interpretation that the registration policy for new SCRAM-* mechanisms are "IETF Review", which requires an RFC. Therefor, I will suggest to IANA that they turn down the registration request until that has been fulfilled. Personally, I see nothing wrong with registering this, given that a GSS-API OID is allocated at the same time. /Simon You wrote: > Dear all, > > We have received a request to register the SCRAM-SHA-256 and > SCRAM-SHA-256-PLUS mechanism. According to my understanding of what > RFC 5802 section 10 says, the registration process is "IETF Review" > http://tools.ietf.org/html/rfc5226#page-11 which requires an RFC, but > I may be mistaken. Anyway, suggestions on how to deal with the > registration request is appreciated. > > Having a SCRAM with SHA-256 seems like a fairly non-controversial > thing to me. There are interop aspects though, and the utility of > defining a lot of variants could be debated. I would like to see a > GSS-API OID registered at the same time for any new SCRAM-SHA-* family > member, but it seems we forgot to write a policy to make sure that > happens. Other thoughts? > > /Simon > > You wrote: > > > Dear Simon, > > > > IANA has received a request from Tony Hansen (tony@att.com) for two > > new registrations in the SASL Mechanisms registry at > > http://www.iana.org/assignments/sasl-mechanisms. > > > > Please let us know when the two-week review period on sasl@ietf.org > > is complete. > > > > thanks, > > > > Amanda Baber > > IANA Request Specialist > > ICANN > > > > === > > > > IANA, please register the following: > > > > To: iana@iana.org > > Subject: Registration of a new SASL mechanism SCRAM-SHA-256 > > > > SASL mechanism name (or prefix for the family): SCRAM-SHA-256 > > Security considerations: Section 7 of [RFC5802] > > Published specification (optional, recommended): [RFC5802] > > Person & email address to contact for further information: > > IETF SASL WG > > Intended usage: COMMON > > Owner/Change controller: IESG > > Note: > > > > To: iana@iana.org > > Subject: Registration of a new SASL mechanism SCRAM-SHA-256-PLUS > > > > SASL mechanism name (or prefix for the family): SCRAM-SHA-256-PLUS > > Security considerations: Section 7 of [RFC5802] > > Published specification (optional, recommended): [RFC5802] > > Person & email address to contact for further information: > > IETF SASL WG > > Intended usage: COMMON > > Owner/Change controller: IESG > > Note: > > > From nobody Thu Apr 10 16:10:27 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D62D1A0323 for ; Thu, 10 Apr 2014 16:10:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IHE_fu-1dQeK for ; Thu, 10 Apr 2014 16:10:20 -0700 (PDT) Received: from mail-oa0-x22e.google.com (mail-oa0-x22e.google.com [IPv6:2607:f8b0:4003:c02::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 271EB1A0314 for ; Thu, 10 Apr 2014 16:10:20 -0700 (PDT) Received: by mail-oa0-f46.google.com with SMTP id i7so5307231oag.33 for ; Thu, 10 Apr 2014 16:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cridland.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=/cINn7Akc3I4VuwVtF3inN1zzHlQEekWlh+kijDEjvk=; b=WgDpz4tI4+GxN15wYtR1LpFIjDJvLMY03sIlxjcLQZhWpdPjb7SHW/27ZMouxC5AX3 /LgABBbibY7UZ7p777H1iAhIEkJygcl2+OF2GhnQo/rZOG0OoHAciLNYcLQ5rzs2LkhB SvYZ3kASAELTzkjKHpzdKT1K964CpWYb8e9i4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=/cINn7Akc3I4VuwVtF3inN1zzHlQEekWlh+kijDEjvk=; b=IVEJP4CbUR7kOqfC38nW0vR86WDdX9BN2PIfU9RMi1CvjC22lNNwEWicUgPHH9PbSR 8MeZiFhzgFQMThA/KkUM8z985VrQ/3jdmTCN2HMS6jnW5r7ZcJpieKbd/wGO5ZBznKzg bsz1e4KntyeGI7oGp0N0IwAuOdHNNHtabxbnn8kjYqxoHpFqRXK59USVce9B/fnU8SBO j0UFymXONvugNXOkjYwxfWZ0xktso6PkKCzQjHJEbTAaJAvLYBWv9pkyop1zUyymT7V+ gVgyAcTT+ZYieUfi5ZGdar5r+9UlIs7EnpGw0vAhJdK6iLHANEDCw1RxGx9KfSHPx8WS pQ2A== X-Gm-Message-State: ALoCoQmZi1AF+hXy3kKXTK9IZZxSrYPXJZPrLYrpY68OxbcAa8HgPQ8/cHHFXwmnEl2uXbz9fsWs MIME-Version: 1.0 X-Received: by 10.182.166.40 with SMTP id zd8mr16089134obb.25.1397171419015; Thu, 10 Apr 2014 16:10:19 -0700 (PDT) Received: by 10.60.93.6 with HTTP; Thu, 10 Apr 2014 16:10:18 -0700 (PDT) In-Reply-To: <20140411001759.3d89cfb5@latte.josefsson.org> References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> Date: Fri, 11 Apr 2014 00:10:18 +0100 Message-ID: From: Dave Cridland To: Simon Josefsson Content-Type: multipart/alternative; boundary=e89a8ff1ce021efe9104f6b852de Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/zjYBFVDiCNma96HdHz0ETiTImaI Cc: kitten@ietf.org Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Apr 2014 23:10:24 -0000 --e89a8ff1ce021efe9104f6b852de Content-Type: text/plain; charset=ISO-8859-1 On 10 April 2014 23:17, Simon Josefsson wrote: > I haven't seen anyone disagree with my interpretation that the > registration policy for new SCRAM-* mechanisms are "IETF Review", which > requires an RFC. Therefor, I will suggest to IANA that they turn down > the registration request until that has been fulfilled. > Yes, they're IETF Review. Although RFC 5802 is generally hash agnostic, a handful of parts of SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimum iteration count for example, so an RFC might prove useful anyway. Dave. --e89a8ff1ce021efe9104f6b852de Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On 1= 0 April 2014 23:17, Simon Josefsson <simon@josefsson.org> = wrote:
I haven't seen anyone disagree with my i= nterpretation that the
registration policy for new SCRAM-* mechanisms are "IETF Review",= which
requires an RFC. =A0Therefor, I will suggest to IANA that they turn down the registration request until that has been fulfilled.


Yes, they're IETF Review.
Although RFC 5802 is generally hash agnostic, a handful of part= s of SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimu= m iteration count for example, so an RFC might prove useful anyway.

Dave.
--e89a8ff1ce021efe9104f6b852de-- From nobody Thu Apr 10 19:59:41 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 580091A001D for ; Thu, 10 Apr 2014 19:59:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.871 X-Spam-Level: X-Spam-Status: No, score=-2.871 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.272] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TxMDplsvU0hV for ; Thu, 10 Apr 2014 19:59:27 -0700 (PDT) Received: from egssmtp03.att.com (egssmtp03.att.com [144.160.128.152]) by ietfa.amsl.com (Postfix) with ESMTP id A13371A0020 for ; Thu, 10 Apr 2014 19:59:26 -0700 (PDT) Received: from mailgw1.maillennium.att.com (maillennium.att.com [135.25.114.99]) by egssmtp03.att.com ( egs 8.14.5/8.14.5) with ESMTP id s3B2xJWd021388 for ; Thu, 10 Apr 2014 19:59:24 -0700 Received: from vpn-135-70-100-137.vpn.swst.att.com ([135.70.100.137]) by maillennium.att.com (mailgw1) with ESMTP id <20140411025918gw100j0choe>; Fri, 11 Apr 2014 02:59:18 +0000 X-Originating-IP: [135.70.100.137] Message-ID: <53475A88.3060202@att.com> Date: Thu, 10 Apr 2014 22:59:20 -0400 From: Tony Hansen User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: kitten@ietf.org References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> In-Reply-To: Content-Type: multipart/alternative; boundary="------------030607050304010800050405" Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/dx1tAHnCi4uPoG4ySvdEyvvkI9M Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 02:59:35 -0000 This is a multi-part message in MIME format. --------------030607050304010800050405 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 4/10/14, 7:10 PM, Dave Cridland wrote: > On 10 April 2014 23:17, Simon Josefsson > wrote: > > I haven't seen anyone disagree with my interpretation that the > registration policy for new SCRAM-* mechanisms are "IETF Review", > which > requires an RFC. Therefor, I will suggest to IANA that they turn down > the registration request until that has been fulfilled. > > > > Yes, they're IETF Review. > > Although RFC 5802 is generally hash agnostic, a handful of parts of > SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the > minimum iteration count for example, so an RFC might prove useful anyway. OK, I figured it was worth trying to do it this way. I'll start the RFC process. Dave, a question for you: What do you think a better minimum iteration count should be for SCRAM-SHA-256? Why should it be any different than the value specified for SCRAM-SHA-1 (4096)? One of the items in 5802 that is out of date is the email address to send registrations to, as it specifies sasl@ietf.org which no longer exists. So I think an update to that part of 5802 is needed to point to the kitten list. Thoughts? Are there any other updates needed for 5802? Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any other SCRAM mechanism? Tony Hansen --------------030607050304010800050405 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 4/10/14, 7:10 PM, Dave Cridland wrote:
On 10 April 2014 23:17, Simon Josefsson <simon@josefsson.org> wrote:
I haven't seen anyone disagree with my interpretation that the
registration policy for new SCRAM-* mechanisms are "IETF Review", which
requires an RFC.  Therefor, I will suggest to IANA that they turn down
the registration request until that has been fulfilled.


Yes, they're IETF Review.

Although RFC 5802 is generally hash agnostic, a handful of parts of SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimum iteration count for example, so an RFC might prove useful anyway.

OK, I figured it was worth trying to do it this way. I'll start the RFC process.

Dave, a question for you: What do you think a better minimum iteration count should be for SCRAM-SHA-256? Why should it be any different than the value specified for SCRAM-SHA-1 (4096)?

One of the items in 5802 that is out of date is the email address to send registrations to, as it specifies sasl@ietf.org which no longer exists. So I think an update to that part of 5802 is needed to point to the kitten list. Thoughts? Are there any other updates needed for 5802?

Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any other SCRAM mechanism?

    Tony Hansen
--------------030607050304010800050405-- From nobody Thu Apr 10 20:36:04 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1139C1A001D for ; Thu, 10 Apr 2014 20:36:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EOizNUPXgDFz for ; Thu, 10 Apr 2014 20:35:56 -0700 (PDT) Received: from smtp.stanford.edu (smtp3.Stanford.EDU [171.67.219.83]) by ietfa.amsl.com (Postfix) with ESMTP id CF6171A042D for ; Thu, 10 Apr 2014 20:20:34 -0700 (PDT) Received: from smtp.stanford.edu (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 9B25B102130; Thu, 10 Apr 2014 20:20:12 -0700 (PDT) Received: from windlord.stanford.edu (windlord.Stanford.EDU [171.67.225.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.stanford.edu (Postfix) with ESMTPS id DF2D0102085; Thu, 10 Apr 2014 20:20:11 -0700 (PDT) Received: by windlord.stanford.edu (Postfix, from userid 1000) id 4098C2F71A; Thu, 10 Apr 2014 20:20:10 -0700 (PDT) From: Russ Allbery To: Tony Hansen In-Reply-To: <53475A88.3060202@att.com> (Tony Hansen's message of "Thu, 10 Apr 2014 22:59:20 -0400") Organization: The Eyrie References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <53475A88.3060202@att.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux) Date: Thu, 10 Apr 2014 20:20:10 -0700 Message-ID: <87d2goa6xh.fsf@windlord.stanford.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/vCCYT0ASVyG_wbfq43UfMFw2h_g Cc: kitten@ietf.org Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 03:36:01 -0000 Tony Hansen writes: > OK, I figured it was worth trying to do it this way. I'll start the RFC > process. > Dave, a question for you: What do you think a better minimum iteration > count should be for SCRAM-SHA-256? Why should it be any different than > the value specified for SCRAM-SHA-1 (4096)? It might be worth considering increasing the minimum iteration count to something that takes appreciable time on modern hardware. I've not tested SCRAM-SHA-256, but PBKDF2 with SHA-256 requires around 15,000 rounds to take 0.1 seconds on a typical desktop system. -- Russ Allbery (eagle@eyrie.org) From nobody Thu Apr 10 20:36:06 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AC701A041D for ; Thu, 10 Apr 2014 20:36:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.172 X-Spam-Level: X-Spam-Status: No, score=-2.172 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.272] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4_7YOmA4YcjV for ; Thu, 10 Apr 2014 20:35:59 -0700 (PDT) Received: from egssmtp02.att.com (egssmtp02.att.com [144.160.128.166]) by ietfa.amsl.com (Postfix) with ESMTP id C96F21A0425 for ; Thu, 10 Apr 2014 20:24:26 -0700 (PDT) Received: from mailgw1.maillennium.att.com (maillennium.att.com [135.25.114.99]) by egssmtp02.att.com ( EGS R6 8.14.5/8.14.5) with ESMTP id s3B3OPjt002671 for ; Thu, 10 Apr 2014 20:24:25 -0700 Received: from vpn-135-70-100-137.vpn.swst.att.com ([135.70.100.137]) by maillennium.att.com (mailgw1) with ESMTP id <20140411032420gw100j0chre>; Fri, 11 Apr 2014 03:24:25 +0000 X-Originating-IP: [135.70.100.137] Message-ID: <53476066.3090206@att.com> Date: Thu, 10 Apr 2014 23:24:22 -0400 From: Tony Hansen User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: kitten@ietf.org References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <53475A88.3060202@att.com> <87d2goa6xh.fsf@windlord.stanford.edu> In-Reply-To: <87d2goa6xh.fsf@windlord.stanford.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/sSSPHBk6AS6ek_C_fcS5DMjhHMc Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 03:36:04 -0000 On 4/10/14, 11:20 PM, Russ Allbery wrote: > Tony Hansen writes: > >> OK, I figured it was worth trying to do it this way. I'll start the RFC >> process. >> Dave, a question for you: What do you think a better minimum iteration >> count should be for SCRAM-SHA-256? Why should it be any different than >> the value specified for SCRAM-SHA-1 (4096)? > It might be worth considering increasing the minimum iteration count to > something that takes appreciable time on modern hardware. I've not tested > SCRAM-SHA-256, but PBKDF2 with SHA-256 requires around 15,000 rounds to > take 0.1 seconds on a typical desktop system. On the other hand, we've found that 4096 is somewhat onerous and barely tolerable on most smart phones. Tony Hansen From nobody Fri Apr 11 01:46:49 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDC1A1A044A for ; Fri, 11 Apr 2014 01:46:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jEDsl0zCQ5B2 for ; Fri, 11 Apr 2014 01:46:43 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) by ietfa.amsl.com (Postfix) with ESMTP id 5BE731A043F for ; Fri, 11 Apr 2014 01:46:42 -0700 (PDT) Received: from latte.josefsson.org (46.182.205.36.c.fiberdirekt.net [46.182.205.36]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id s3B8kak9008042 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 11 Apr 2014 10:46:38 +0200 Date: Fri, 11 Apr 2014 10:46:31 +0200 From: Simon Josefsson To: Dave Cridland Message-ID: <20140411104631.15ffa951@latte.josefsson.org> In-Reply-To: References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.98.1 at duva.sjd.se X-Virus-Status: Clean Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/zfOUa3dT82kQ3dowIfG06XJX_6I Cc: kitten@ietf.org Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 08:46:48 -0000 You wrote: > On 10 April 2014 23:17, Simon Josefsson wrote: > > > I haven't seen anyone disagree with my interpretation that the > > registration policy for new SCRAM-* mechanisms are "IETF Review", > > which requires an RFC. Therefor, I will suggest to IANA that they > > turn down the registration request until that has been fulfilled. > > Yes, they're IETF Review. Although I noticed now that RFC 4402 says family mechanism instances are expert review, so the requirements is a bit confusing. However I think what's in RFC 5802 has more weight regarding SCRAM, and I think this was actually discussed before. > Although RFC 5802 is generally hash agnostic, a handful of parts of > SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the > minimum iteration count for example, so an RFC might prove useful > anyway. Yes, that and the GSS-API OID. /Simon From nobody Fri Apr 11 03:36:01 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 773A91A03B6 for ; Fri, 11 Apr 2014 03:35:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFEeqtP6OkW9 for ; Fri, 11 Apr 2014 03:35:57 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) by ietfa.amsl.com (Postfix) with ESMTP id EE19D1A02D5 for ; Fri, 11 Apr 2014 03:35:56 -0700 (PDT) Received: from latte.josefsson.org (46.182.205.36.c.fiberdirekt.net [46.182.205.36]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id s3BAZlew028366 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 11 Apr 2014 12:35:48 +0200 Date: Fri, 11 Apr 2014 12:35:40 +0200 From: Simon Josefsson To: Tony Hansen Message-ID: <20140411123540.5114a2c0@latte.josefsson.org> In-Reply-To: <53475A88.3060202@att.com> References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <53475A88.3060202@att.com> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.98.1 at duva.sjd.se X-Virus-Status: Clean Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/DElRig-BQanJmfhzV3zlGzTyIf0 Cc: kitten@ietf.org Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 10:35:58 -0000 You wrote: > One of the items in 5802 that is out of date is the email address to > send registrations to, as it specifies sasl@ietf.org which no longer > exists. So I think an update to that part of 5802 is needed to point > to the kitten list. Thoughts? Are there any other updates needed for > 5802? There is a couple of RFC errata's already. It may make sense to file another one for the incorrect email address. > Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any > other SCRAM mechanism? It doesn't have to. /Simon From nobody Fri Apr 11 04:04:38 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C85771A01DB for ; Fri, 11 Apr 2014 04:04:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RnkHX3Cn4-88 for ; Fri, 11 Apr 2014 04:04:33 -0700 (PDT) Received: from mail-oa0-x235.google.com (mail-oa0-x235.google.com [IPv6:2607:f8b0:4003:c02::235]) by ietfa.amsl.com (Postfix) with ESMTP id C2CFF1A01E4 for ; Fri, 11 Apr 2014 04:04:33 -0700 (PDT) Received: by mail-oa0-f53.google.com with SMTP id j17so5916723oag.40 for ; Fri, 11 Apr 2014 04:04:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cridland.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=4RTwxdUWbEFEXMmyWHwGW986m34596iR6gdCDJlK/tk=; b=DRRzPDj2cXyGgQdmp6ChJQq71rYwcMeTA3LqzgeUUnc1+VEJkh6a4j/aQ1Z8OBmTuF 4o/g+l8BP1behLTiKFzyQ7Iy3bPVNZrZkQCNqcWa22xGhC0+wZmfQsKZZH6D0tXMrgtp sVnuxReGUIqLnhWP5AEDWHLMbs0ryXcgLYcFg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=4RTwxdUWbEFEXMmyWHwGW986m34596iR6gdCDJlK/tk=; b=S560SFlt6IL99YlwHR8FEiCCdkZwhv+dkZeg/rAgFJ2c/nAnhdrB6PzwZvVOemVnio Y3QjfrwctZg5/M3FC2xtDDfJgBPvdP4bK/k0nobOvoSKTqdTfdgc53V0ClxVLfdN3ZAK 9bqe0yWM188tL6g37UQrsDooccQi1gYxdv0CtXn+MnP9TYS7cgmk7pkHONH8xKlqHF5m OXjWDIoH6qHar88vy+VCusPRqv9uXa/vcJJVMKInXFBoTk46N+8WUpzZdET6Gl7ffxP6 Cw3rRuXPzv1bXcF3FXqfojF/YdLmgHB5uU/FlXFkjIq1xS0QxfxETxvUG3XpIoR/XNCk t59Q== X-Gm-Message-State: ALoCoQlRXbZcPoxv4d/PjMNNJbj8EsbO4qOr9IzVFLLKcf5hN0ezJ7WEw1uuc0+ZddI381ws21MY MIME-Version: 1.0 X-Received: by 10.60.157.202 with SMTP id wo10mr7028452oeb.9.1397214272458; Fri, 11 Apr 2014 04:04:32 -0700 (PDT) Received: by 10.60.93.6 with HTTP; Fri, 11 Apr 2014 04:04:32 -0700 (PDT) Received: by 10.60.93.6 with HTTP; Fri, 11 Apr 2014 04:04:32 -0700 (PDT) In-Reply-To: <53475A88.3060202@att.com> References: <5319DE8B.1030202@att.com> <20140312162849.152e924b@latte.josefsson.org> <20140411001759.3d89cfb5@latte.josefsson.org> <53475A88.3060202@att.com> Date: Fri, 11 Apr 2014 12:04:32 +0100 Message-ID: From: Dave Cridland To: Tony Hansen Content-Type: multipart/alternative; boundary=047d7bd6c5e862a22e04f6c24cc9 Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/5MUBfzA7Fn9jxDmeDh2EgxAJISc Cc: kitten@ietf.org Subject: Re: [kitten] [IANA #748877] please review SASL-SCRAM-256 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 11:04:37 -0000 --047d7bd6c5e862a22e04f6c24cc9 Content-Type: text/plain; charset=ISO-8859-1 On 11 Apr 2014 03:59, "Tony Hansen" wrote: > > On 4/10/14, 7:10 PM, Dave Cridland wrote: >> >> On 10 April 2014 23:17, Simon Josefsson wrote: >>> >>> I haven't seen anyone disagree with my interpretation that the >>> registration policy for new SCRAM-* mechanisms are "IETF Review", which >>> requires an RFC. Therefor, I will suggest to IANA that they turn down >>> the registration request until that has been fulfilled. >> >> >> >> Yes, they're IETF Review. >> >> Although RFC 5802 is generally hash agnostic, a handful of parts of SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimum iteration count for example, so an RFC might prove useful anyway. > > > OK, I figured it was worth trying to do it this way. I'll start the RFC process. > > Dave, a question for you: What do you think a better minimum iteration count should be for SCRAM-SHA-256? Why should it be any different than the value specified for SCRAM-SHA-1 (4096)? > No idea. I just noted that the iteration count was specific to the hash algorithm. > One of the items in 5802 that is out of date is the email address to send registrations to, as it specifies sasl@ietf.org which no longer exists. So I think an update to that part of 5802 is needed to point to the kitten list. Thoughts? Are there any other updates needed for 5802? > > Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any other SCRAM mechanism? > Let me counter that with a question. Why pick SHA-256 in particular? Why not jump to SHA-512, or SHA-3? > Tony Hansen > > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten > --047d7bd6c5e862a22e04f6c24cc9 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable


On 11 Apr 2014 03:59, "Tony Hansen" <tony@att.com> wrote:
>
> On 4/10/14, 7:10 PM, Dave Cridland wrote:
>>
>> On 10 April 2014 23:17, Simon Josefsson <simon@josefsson.org> wrote:
>>>
>>> I haven't seen anyone disagree with my interpretation that= the
>>> registration policy for new SCRAM-* mechanisms are "IETF = Review", which
>>> requires an RFC. =A0Therefor, I will suggest to IANA that they= turn down
>>> the registration request until that has been fulfilled.
>>
>>
>>
>> Yes, they're IETF Review.
>>
>> Although RFC 5802 is generally hash agnostic, a handful of parts o= f SCRAM are defined specific to SCRAM-SHA-1[-PLUS], including the minimum i= teration count for example, so an RFC might prove useful anyway.
>
>
> OK, I figured it was worth trying to do it this way. I'll start th= e RFC process.
>
> Dave, a question for you: What do you think a better minimum iteration= count should be for SCRAM-SHA-256? Why should it be any different than the= value specified for SCRAM-SHA-1 (4096)?
>

No idea. I just noted that the iteration count was specific = to the hash algorithm.

> One of the items in 5802 that is out of date is the ema= il address to send registrations to, as it specifies sasl@ietf.org which no longer exists. So I think an update t= o that part of 5802 is needed to point to the kitten list. Thoughts? Are th= ere any other updates needed for 5802?
>
> Another question: should an RFC for SCRAM-SHA-256[-PLUS] register any = other SCRAM mechanism?
>

Let me counter that with a question. Why pick SHA-256 in par= ticular? Why not jump to SHA-512, or SHA-3?

> =A0=A0=A0 Tony Hansen
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.i= etf.org/mailman/listinfo/kitten
>

--047d7bd6c5e862a22e04f6c24cc9-- From nobody Fri Apr 11 12:38:20 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EEF41A0309 for ; Fri, 11 Apr 2014 12:38:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.871 X-Spam-Level: X-Spam-Status: No, score=-2.871 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.272] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l9k68fVHzPVM for ; Fri, 11 Apr 2014 12:38:15 -0700 (PDT) Received: from egssmtp03.att.com (egssmtp03.att.com [144.160.128.152]) by ietfa.amsl.com (Postfix) with ESMTP id 3D2B91A02FA for ; Fri, 11 Apr 2014 12:38:15 -0700 (PDT) Received: from dns.maillennium.att.com (maillennium.att.com [135.25.114.99]) by egssmtp03.att.com ( egs 8.14.5/8.14.5) with ESMTP id s3BJcCJL020780 for ; Fri, 11 Apr 2014 12:38:13 -0700 Received: from ds135-91-110-232.dhcps.ugn.att.com ([135.91.110.232]) by maillennium.att.com (mailgw1) with ESMTP id <20140411193812gw100j0ci2e>; Fri, 11 Apr 2014 19:38:12 +0000 X-Originating-IP: [135.91.110.232] Message-ID: <534844A4.7030304@att.com> Date: Fri, 11 Apr 2014 15:38:12 -0400 From: Tony Hansen User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: kitten@ietf.org References: <20140411193636.13894.48805.idtracker@ietfa.amsl.com> In-Reply-To: <20140411193636.13894.48805.idtracker@ietfa.amsl.com> X-Forwarded-Message-Id: <20140411193636.13894.48805.idtracker@ietfa.amsl.com> Content-Type: multipart/alternative; boundary="------------080008090205000500050906" Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/1vlE7TijGnHTpEZe7pslnmkX8Lg Subject: [kitten] Fwd: I-D Action: draft-hansen-scram-sha256-00.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 19:38:19 -0000 This is a multi-part message in MIME format. --------------080008090205000500050906 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit As promised, here is an internet draft to register SCRAM-SHA-256[-PLUS]. Tony Hansen -------- Original Message -------- Subject: I-D Action: draft-hansen-scram-sha256-00.txt Date: Fri, 11 Apr 2014 12:36:36 -0700 From: internet-drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : SCRAM-SHA-256 and SCRAM-SHA-256-PLUS SASL Mechanisms Author : Tony Hansen Filename : draft-hansen-scram-sha256-00.txt Pages : 5 Date : 2014-04-11 Abstract: This document registers the SASL mechanisms SCRAM-SHA-256 and SCRAM- SHA-256-PLUS. It also updates RFC 5802 in minor ways. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-hansen-scram-sha256/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-hansen-scram-sha256-00 --------------080008090205000500050906 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit As promised, here is an internet draft to register SCRAM-SHA-256[-PLUS].

    Tony Hansen


-------- Original Message --------
Subject: I-D Action: draft-hansen-scram-sha256-00.txt
Date: Fri, 11 Apr 2014 12:36:36 -0700
From: internet-drafts@ietf.org
Reply-To: internet-drafts@ietf.org
To: i-d-announce@ietf.org 

A New Internet-Draft is available from the on-line Internet-Drafts directories.


        Title           : SCRAM-SHA-256 and SCRAM-SHA-256-PLUS SASL Mechanisms
        Author          : Tony Hansen
	Filename        : draft-hansen-scram-sha256-00.txt
	Pages           : 5
	Date            : 2014-04-11

Abstract:
   This document registers the SASL mechanisms SCRAM-SHA-256 and SCRAM-
   SHA-256-PLUS.  It also updates RFC 5802 in minor ways.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-hansen-scram-sha256/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-hansen-scram-sha256-00
--------------080008090205000500050906-- From nobody Fri Apr 11 13:45:41 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF7191A074C for ; Fri, 11 Apr 2014 13:45:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xo48-vK4Yyty for ; Fri, 11 Apr 2014 13:45:38 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) by ietfa.amsl.com (Postfix) with ESMTP id 5E6E61A0737 for ; Fri, 11 Apr 2014 13:45:37 -0700 (PDT) Received: from latte.josefsson.org (static-213-115-179-130.sme.bredbandsbolaget.se [213.115.179.130]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id s3BKjTSF010980 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 11 Apr 2014 22:45:31 +0200 Date: Fri, 11 Apr 2014 22:45:28 +0200 From: Simon Josefsson To: Tony Hansen Message-ID: <20140411224528.3abf6ee2@latte.josefsson.org> In-Reply-To: <534844A4.7030304@att.com> References: <20140411193636.13894.48805.idtracker@ietfa.amsl.com> <534844A4.7030304@att.com> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.98.1 at duva.sjd.se X-Virus-Status: Clean Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/iwu260PM7QM0ial0YGlifQakpHk Cc: kitten@ietf.org Subject: Re: [kitten] Fwd: I-D Action: draft-hansen-scram-sha256-00.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 20:45:40 -0000 You wrote: > As promised, here is an internet draft to register > SCRAM-SHA-256[-PLUS]. Thanks. It looks good to me. If you are not saying anything about GSS-API per-message token algorithm, you will end up getting aes128-cts-hmac-sha1-96 there because that's what RFC 5802 says. Is that OK with you? I don't think there is a SHA2-based Kerberos enctype registered yet. I don't see this as a problem, I just wanted to make a note of it -- some people may consider it a bit misaligned. /Simon From nobody Mon Apr 28 14:43:09 2014 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10CFA1A86F5; Mon, 28 Apr 2014 14:43:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_TVD_MIME_NO_HEADERS=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v8eqTB5PQjq1; Mon, 28 Apr 2014 14:43:03 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C2F41A7035; Mon, 28 Apr 2014 14:43:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.4.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140428214303.28332.61888.idtracker@ietfa.amsl.com> Date: Mon, 28 Apr 2014 14:43:03 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/1p2ZI9Hc6larAi63Oi23Du0Um9E Cc: kitten@ietf.org Subject: [kitten] I-D ACTION:draft-ietf-kitten-rfc4402bis-00.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Apr 2014 21:43:05 -0000 --NextPart A new Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF. Title : A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism Author(s) : S. Emery, et al Filename : draft-ietf-kitten-rfc4402bis Pages : 6 Date : 2014-04-28 This document defines the Pseudo-Random Function (PRF) for the Kerberos V mechanism for the Generic Security Service Application Program Interface (GSS-API), based on the PRF defined for the Kerberos V cryptographic framework, for keying application protocols given an established Kerberos V GSS-API security context. This document obsoletes RFC 4402 and reclassifies that document as historic. RFC 4402 was underspecified, leading to interoperability problems. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-rfc4402bis-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-kitten-rfc4402bis"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2014-04-28144303.I-D@ietf.org> --NextPart--