Subject: [saag] Public key based mechanism for SASL

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 11 Feb 2016 20:58:55 +0000 (UTC)

The Mathematical Mesh makes it really easy to manage public key pairs for end user authentication. Currently I am using it to manage S/MIME and OpenPGP key pairs.
However, the authentication to the mail client is still via SASL and right now, none of the mail clients I am aware of do anything other than password auth. And many of them only support broken, insecure mechanisms. Ugh!
Given that I can easily generate and associate a unique key pair to each device, the obvious step is to use PKI for authentication. SASL certainly should be able to support this but before I invent something, I thought I would check to see if I was re-inventing the wheel.

The constraints I was thinking of were:
1) Based on Diffie Hellman problem (for EC compatibility)2) Use client and server nonces to defeat MITM attacks.
Obviously has to be unencumbered.

Sent from Outlook Mobile