From owner-ietf-sasl Tue May 6 04:46:17 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkGi2066614 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BkGkN066613 for ietf-sasl-bks; Tue, 6 May 2003 04:46:16 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkFi2066608 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15357; Tue, 6 May 2003 07:43:18 -0400 (EDT) Message-Id: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-plain-01.txt Date: Tue, 06 May 2003 07:43:18 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Plain SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt Pages : 8 Date : 2003-5-5 This document defines a simple clear-text user/password Simple Authentication and Security Layer (SASL) mechanism called the PLAIN mechanism. The PLAIN mechanism intended to be used, in combination with data confidentiality services provided by a lower layer, in protocols which lack a simple password authentication command. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-plain-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-plain-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-plain-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-plain-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-plain-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 04:44:44 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Biii2066558 for ; Tue, 6 May 2003 04:44:44 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BiiSf066557 for ietf-sasl-bks; Tue, 6 May 2003 04:44:44 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bihi2066551 for ; Tue, 6 May 2003 04:44:43 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15295; Tue, 6 May 2003 07:41:46 -0400 (EDT) Message-Id: <200305061141.HAA15295@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-anon-01.txt Date: Tue, 06 May 2003 07:41:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Anonymous SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-anon-01.txt Pages : 8 Date : 2003-5-5 It is common practice on the Internet to permit anonymous access to various services. Traditionally, this has been done with a plain text password mechanism using 'anonymous' as the user name and optional trace information, such as an email address, as the password. As plaintext login commands are not permitted in new IETF protocols, a new way to provide anonymous login is needed within the context of the Simple Authentication and Security Layer (SASL) framework. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-anon-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-anon-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-anon-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-anon-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-anon-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 04:44:39 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bidi2066545 for ; Tue, 6 May 2003 04:44:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BidJx066544 for ietf-sasl-bks; Tue, 6 May 2003 04:44:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bici2066539 for ; Tue, 6 May 2003 04:44:38 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15279; Tue, 6 May 2003 07:41:41 -0400 (EDT) Message-Id: <200305061141.HAA15279@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-01.txt Date: Tue, 06 May 2003 07:41:41 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-01.txt Pages : 5 Date : 2003-5-5 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 07:42:41 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egfi2080227 for ; Tue, 6 May 2003 07:42:41 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EgfAd080226 for ietf-sasl-bks; Tue, 6 May 2003 07:42:41 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egei2080221 for ; Tue, 6 May 2003 07:42:40 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46Egfc6009677 for ; Tue, 6 May 2003 14:42:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506073836.02c7b3e8@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:40:12 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: PLAIN In-Reply-To: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-plain based upon list and off-list comments. Please review and comment. From owner-ietf-sasl Tue May 6 07:43:31 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhVi2080249 for ; Tue, 6 May 2003 07:43:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EhVxT080248 for ietf-sasl-bks; Tue, 6 May 2003 07:43:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhUi2080243 for ; Tue, 6 May 2003 07:43:30 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46EhVc6009682 for ; Tue, 6 May 2003 14:43:31 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506074017.02c84be0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:41:02 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: SASLprep Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-saslprep based upon list and off-list comment. Please review and comment. Thanks, Kurt From owner-ietf-sasl Sat May 17 12:16:27 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGRAF092906 for ; Sat, 17 May 2003 12:16:27 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HJGRUu092905 for ietf-sasl-bks; Sat, 17 May 2003 12:16:27 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGQAF092900 for ; Sat, 17 May 2003 12:16:26 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id AE804152451; Sat, 17 May 2003 15:12:42 -0400 (EDT) To: ietf-sasl@imc.org Subject: Last Call for draft-ietf-sasl-plain-01 From: Sam Hartman Date: Sat, 17 May 2003 15:12:42 -0400 Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This message initiates a SASL Working Group Last Call on the document: Title : The Plain SASL Mechanism Editor : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt The purpose of this WG Last Call is to ensure that the Working Group has achieved consensus that the document is suitable for publication as a Proposed Standard. Please review the document for both technical and editorial problems. Technical issues should be discussed on this list. Editorial issues may be sent to the document editor. The Last Call period will end on Monday, June 2, 2003. Upon completion of the last call, the WG chair(s) will take action based upon the consensus of the WG. Possible actions include: 1) recommending to the IETF Security Area Directors that the document, after possible editorial or other minor changes, be considered by the IESG for publication as a Standard Track RFC (which generally involves an IETF-wide Last Call); or 2) requiring that outstanding issues be adequately addressed prior to further action (including, possibly, another WG Last Call). Remember that it is our responsibility as Working Group members to ensure the quality of our documents and of the Internet Standards process. So, please read and comment! - Sam Hartman SASL co-chair From owner-ietf-sasl Sat May 17 14:02:25 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2PAF096888 for ; Sat, 17 May 2003 14:02:25 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HL2PZf096887 for ietf-sasl-bks; Sat, 17 May 2003 14:02:25 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from yxa.extundo.com (178.230.13.217.in-addr.dgcsystems.net [217.13.230.178]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2NAF096881 for ; Sat, 17 May 2003 14:02:24 -0700 (PDT) (envelope-from jas@extundo.com) Received: from latte-wlan.josefsson.org (yxa.extundo.com [217.13.230.178]) (authenticated bits=0) by yxa.extundo.com (8.12.9/8.12.9) with ESMTP id h4HL2IB4004454 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=OK) for ; Sat, 17 May 2003 23:02:18 +0200 To: ietf-sasl@imc.org Subject: Comments on draft-ietf-sasl-plain-01.txt From: Simon Josefsson X-Payment: hashcash 1.2 0:030517:ietf-sasl@imc.org:89c03113bd990658 X-Hashcash: 0:030517:ietf-sasl@imc.org:89c03113bd990658 Date: Sat, 17 May 2003 23:02:18 +0200 Message-ID: User-Agent: Gnus/5.1003 (Gnus v5.10.3) Emacs/21.3.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Status: No, hits=-6.3 required=5.0 tests=USER_AGENT_GNUS_UA autolearn=ham version=2.50 X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: The server MAY also use the password to initialize any new authentication database, such as one suitable for [CRAM-MD5] or [DIGEST-MD5]. First, DIGEST-MD5 need authcid and authzid too, it isn't possible to initialize a hashed password database suitable for DIGEST-MD5 using the password only. Secondly, how will this interact with the non-ASCII handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN server SASLprep() the strings or not, before hashing them and storing them in the database, for later use with *-MD5? The answer appears to depend on how *-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis does not currently mention SASLprep. Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque data except SPC?), it would be prudent to mention in the security considerations that if someone currently uses non-ASCII usernames in PLAIN, the SASLprep() operation may cause changes to the username. This warning may be more appropriate in the saslprep document, but that document doesn't have a security consideration currently. E.g., if someone has a system with two users "foo" and "fooss", the SASLprep() operation translates the first string into the latter before database comparison, whereas the application does not necessarily perform the same translation. The consequences appears to be that someone who knows the password for "fooss" may also be authenticated as "foo". Thanks. From owner-ietf-sasl Sat May 17 14:30:59 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUxAF097406 for ; Sat, 17 May 2003 14:30:59 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HLUxXo097405 for ietf-sasl-bks; Sat, 17 May 2003 14:30:59 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUwAF097400 for ; Sat, 17 May 2003 14:30:58 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id BF5C3152451; Sat, 17 May 2003 17:26:53 -0400 (EDT) To: Simon Josefsson Cc: ietf-sasl@imc.org Subject: Re: Comments on draft-ietf-sasl-plain-01.txt References: From: Sam Hartman Date: Sat, 17 May 2003 17:26:53 -0400 In-Reply-To: (Simon Josefsson's message of "Sat, 17 May 2003 23:02:18 +0200") Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: >>>>> "Simon" == Simon Josefsson writes: Simon> Secondly, how will this interact with the non-ASCII Simon> handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN Simon> server SASLprep() the strings or not, before hashing them Simon> and storing them in the database, for later use with *-MD5? Simon> The answer appears to depend on how *-MD5bis will handle Simon> non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis Simon> does not currently mention SASLprep. We agreed in San Francisco that digest-md5 would use saslprep. I believe we agreed the same for cram-md5. Those updates are pending. --Sam From owner-ietf-sasl Sun May 18 09:26:04 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ3AF062595 for ; Sun, 18 May 2003 09:26:04 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4IGQ3j2062594 for ietf-sasl-bks; Sun, 18 May 2003 09:26:03 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ2AF062589 for ; Sun, 18 May 2003 09:26:02 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4IGPnc6030201; Sun, 18 May 2003 16:25:50 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030518085943.02780fc0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sun, 18 May 2003 09:23:05 -0700 To: Simon Josefsson From: "Kurt D. Zeilenga" Subject: Re: Comments on draft-ietf-sasl-plain-01.txt Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: At 02:02 PM 5/17/2003, Simon Josefsson wrote: > The server MAY also use the password to initialize any new > authentication database, such as one suitable for [CRAM-MD5] or > [DIGEST-MD5]. > >First, DIGEST-MD5 need authcid and authzid too, Technically speaking, the DIGEST-MD5 A1 hash doesn't include the authzid. >it isn't possible to >initialize a hashed password database suitable for DIGEST-MD5 using >the password only. I'll s/password/credentials/ in the above. >Secondly, how will this interact with the non-ASCII handling in >CRAM-MD5 and DIGEST-MD5? I think that exactly how PLAIN credentials interact with credentials of other mechanisms should be viewed as an implementation detail as the syntax and semantics of those credentials is mechanism specific. But as Sam said, I think the WG intends to use SASLprep for all username and password appearing in such mechanisms. >Should the PLAIN server SASLprep() the >strings or not, before hashing them and storing them in the database, >for later use with *-MD5? The answer appears to depend on how >*-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and >DIGEST-MD5bis does not currently mention SASLprep. > >Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque >data except SPC?), it would be prudent to mention in the security >considerations that if someone currently uses non-ASCII usernames in >PLAIN, the SASLprep() operation may cause changes to the username. >This warning may be more appropriate in the saslprep document, but >that document doesn't have a security consideration currently. E.g., >if someone has a system with two users "foo" and >"fooss", the SASLprep() operation translates the first string into the >latter before database comparison, whereas the application does not >necessarily perform the same translation. The consequences appears to >be that someone who knows the password for "fooss" may also be >authenticated as "foo". Well, saslprep should have a security consideration section. I think it fine to elaborate that the profile as to why it is not intended to be applied to identities which are not simple user names and related issued. Also, I think 2222bis should be more clear that the form which authentication credentials take and how they are used to authenticate the user is mechanism specific. Applications should be avoid overloading syntax and semantics. I don't see the PLAIN I-D needing any additional text here. Kurt From owner-ietf-sasl Wed May 21 05:11:02 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB2AF022972 for ; Wed, 21 May 2003 05:11:02 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4LCB2fG022971 for ietf-sasl-bks; Wed, 21 May 2003 05:11:02 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB1AF022966 for ; Wed, 21 May 2003 05:11:01 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16130; Wed, 21 May 2003 08:11:01 -0400 (EDT) Message-Id: <200305211211.IAA16130@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2222bis-00.txt Date: Wed, 21 May 2003 08:11:00 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Simple Authentication and Security Layer (SASL) Author(s) : A. Melnikov Filename : draft-ietf-sasl-rfc2222bis-00.txt Pages : 18 Date : 2003-5-20 SASL provides a method for adding authentication support with an optional security layer to connection-based protocols. It also describes a structure for authentication mechanisms. The result is an abstraction layer between protocols and authentication mechanisms such that any SASL-compatible authentication mechanism can be used with any SASL-compatible protocol. This document describes how a SASL authentication mechanism is structured, how a protocol adds support for SASL, defines the protocol for carrying a security layer over a connection, and defines the EXTERNAL SASL authentication mechanism. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2222bis-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2222bis-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Wed May 21 06:18:04 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LDI4AF027882 for ; Wed, 21 May 2003 06:18:04 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4LDI4Ik027881 for ietf-sasl-bks; Wed, 21 May 2003 06:18:04 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from db1.contentcatcher.com ([64.19.188.18]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LDI3AF027870 for ; Wed, 21 May 2003 06:18:04 -0700 (PDT) (envelope-from Internet-Drafts@ietf.org) Received: from CC2 ([192.168.200.3]) by db1.contentcatcher.com with Microsoft SMTPSVC(5.0.2195.5329); Wed, 21 May 2003 09:14:25 -0400 x-sender: owner-ietf-announce@ietf.org x-receiver: spamtrap@spam.clearnetwork.com Received: from pf1.contentcatcher.com ([192.168.100.2]) by CC2 with Microsoft SMTPSVC(5.0.2195.5329); Wed, 21 May 2003 09:18:47 -0400 Received: by pf1.contentcatcher.com (Postfix, from userid 502) id 2D9709F615; Wed, 21 May 2003 09:04:14 -0400 (EDT) Received: from asgard.ietf.org (asgard.ietf.org [132.151.6.40]) by pf1.contentcatcher.com (Postfix) with ESMTP id 269179F612; Wed, 21 May 2003 09:04:07 -0400 (EDT) Received: from majordomo by asgard.ietf.org with local (Exim 4.14) id 19ISTg-0003Yc-DN for ietf-announce-list@asgard.ietf.org; Wed, 21 May 2003 08:13:52 -0400 Received: from odin.ietf.org ([10.27.2.28] helo=ietf.org) by asgard.ietf.org with esmtp (Exim 4.14) id 19ISQx-0003V2-2n for all-ietf@asgard.ietf.org; Wed, 21 May 2003 08:11:03 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16130; Wed, 21 May 2003 08:11:01 -0400 (EDT) Message-Id: <200305211211.IAA16130@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" Reply-To: Internet-Drafts@ietf.org Date: Wed, 21 May 2003 08:11:00 -0400 X-Spam-Status: Yes, hits=10.6 required=5.0tests=BAYES_80,CC_Bulk_Header_1,MIME_BOUND_NEXTPART,TO_MALFORMEDversion=2.53-contentcatcher X-Spam-Level: ********** X-Spam-Checker-Version: SpamAssassin 2.53-contentcatcher (1.174.2.15-2003-03-30-exp) X-Spam-Report: ---- Start SpamAssassin results10.60 points, 5 required;* 1.8 -- To: has a malformed address* 5.0 -- Mail has precedence set to bulk* 3.5 -- BODY: Bayesian classifier says spam probability is 80 to 90%[score: 0.8048]* 0.3 -- Spam tool pattern in MIME boundary---- End of SpamAssassin results X-Spam-Flag: YES X-VIRUS-FOUND: NO X-GHOST-SENDER: owner-ietf-announce@ietf.org X-GHOST-RECEIVER: braja@tellium.com X-OriginalArrivalTime: 21 May 2003 13:18:47.0500 (UTC) FILETIME=[830460C0:01C31F9B] x-contentCatcher: ContentCatcher build 0407021738 Cc: ietf-sasl@imc.org To: braja@tellium.com From: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2222bis-00.txt [owner-ietf-announce@ietf.org in Pass-Through List] ['from' in Pass-Through List] Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is a multi-part message in MIME format. --NextPart Title : Simple Authentication and Security Layer (SASL) Author(s) : A. Melnikov Filename : draft-ietf-sasl-rfc2222bis-00.txt Pages : 18 Date : 2003-5-20 SASL provides a method for adding authentication support with an optional security layer to connection-based protocols. It also describes a structure for authentication mechanisms. The result is an abstraction layer between protocols and authentication mechanisms such that any SASL-compatible authentication mechanism can be used with any SASL-compatible protocol. This document describes how a SASL authentication mechanism is structured, how a protocol adds support for SASL, defines the protocol for carrying a security layer over a connection, and defines the EXTERNAL SASL authentication mechanism. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2222bis-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" This is a multi-part message in MIME format. --OtherAccess Content-Type: Message/External-body;access-type="mail-server";server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt --OtherAccess Content-Type: Message/External-body;name="draft-ietf-sasl-rfc2222bis-00.txt";site="ftp.ietf.org";access-type="anon-ftp";directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Fri May 23 10:51:35 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpZAF036698 for ; Fri, 23 May 2003 10:51:35 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4NHpZZg036697 for ietf-sasl-bks; Fri, 23 May 2003 10:51:35 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from urchi.cc.columbia.edu (IDENT:cu41754@urchi.cc.columbia.edu [128.59.31.94]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpXAF036692 for ; Fri, 23 May 2003 10:51:34 -0700 (PDT) (envelope-from giorgi@columbia.edu) Received: from urchi.cc.columbia.edu (localhost [127.0.0.1]) by urchi.cc.columbia.edu (8.12.8/8.12.3) with ESMTP id h4NHpXu1022791 for ; Fri, 23 May 2003 13:51:33 -0400 (EDT) Received: from localhost (giorgi@localhost) by urchi.cc.columbia.edu (8.12.8/8.12.8/Submit) with ESMTP id h4NHpWKj022788 for ; Fri, 23 May 2003 13:51:32 -0400 (EDT) X-Authentication-Warning: urchi.cc.columbia.edu: giorgi owned process doing -bs Date: Fri, 23 May 2003 13:51:32 -0400 (EDT) From: Giorgi Lebanidze To: ietf-sasl@imc.org Subject: problems with using CRAM-MD5 Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: First of all I appologize if this is not teh way I was supposed to contact other subscribers of the list. I'm new to the group. I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call returns SASL_NOUSER -20 /* user not found */. Where does the SASL library look for the users and passwords while authenticating with CRAM-MD5 ? thanks, Giorgi From owner-ietf-sasl Fri May 23 19:00:14 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20DAF052576 for ; Fri, 23 May 2003 19:00:13 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4O20Djl052575 for ietf-sasl-bks; Fri, 23 May 2003 19:00:13 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20CAF052569 for ; Fri, 23 May 2003 19:00:12 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4O209c6084847; Sat, 24 May 2003 02:00:10 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030523185024.0278b740@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 23 May 2003 18:57:22 -0700 To: Giorgi Lebanidze From: "Kurt D. Zeilenga" Subject: Re: problems with using CRAM-MD5 Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I note that the purpose of this list is to discuss the standardization of SASL. Specifically, this list is the home of the IETF SASL WG. Your post seems more appropriate to a list supporting the particular implementation you are using. I suspect you are trying to use the Cyrus SASL library from CMU. If so, you should direct your questions to the mailing list. Regards, Kurt (SASL WG co-chair) At 10:51 AM 5/23/2003, Giorgi Lebanidze wrote: >First of all I appologize if this is not teh way I was supposed to contact >other subscribers of the list. I'm new to the group. You just did contact everyone on the list. >I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 >mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call >returns SASL_NOUSER -20 /* user not found */. Where does the SASL library >look for the users and passwords while authenticating with CRAM-MD5 ? >thanks, >Giorgi From owner-ietf-sasl Tue May 27 02:31:34 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4R9VYAF035725 for ; Tue, 27 May 2003 02:31:34 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4R9VYXt035724 for ietf-sasl-bks; Tue, 27 May 2003 02:31:34 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from fmx4.freemail.hu (fmx4.freemail.hu [195.228.242.224]) by above.proper.com (8.12.9/8.12.8) with SMTP id h4R9VVAF035719 for ; Tue, 27 May 2003 02:31:32 -0700 (PDT) (envelope-from kovacspeter2@freemail.hu) Received: (qmail 73645 invoked from network); 27 May 2003 11:31:31 +0200 Received: from fm3.freemail.hu (195.228.242.203) by fmx4.freemail.hu with SMTP; 27 May 2003 11:31:31 +0200 Received: (qmail 19996 invoked by uid 3421979); 27 May 2003 11:30:15 +0200 Date: Tue, 27 May 2003 11:30:15 +0200 (CEST) From: =?ISO-8859-2?Q?Kov=E1cs_P=E9ter?= Subject: mux.pid To: ietf-sasl@imc.org Message-ID: X-Originating-IP: [81.182.49.222] X-HTTP-User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-2 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Hello, I have a system running FreeBSD 4.8. After running the make world the following error come up in the /var/log/messages file: saslauthd[296]: FATAL: setting master lock on /var/state/saslauthd/mux.pid: Resource temporarily unavailable I recompiled the whole sasl2, but the error still exist. And of course the file exsits as well. It has a number inside. Thanks... From owner-ietf-sasl Wed May 28 04:46:28 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkSAF038205 for ; Wed, 28 May 2003 04:46:28 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SBkSTm038204 for ietf-sasl-bks; Wed, 28 May 2003 04:46:28 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkQAF038199 for ; Wed, 28 May 2003 04:46:27 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA25718; Wed, 28 May 2003 07:46:26 -0400 (EDT) Message-Id: <200305281146.HAA25718@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-02.txt Date: Wed, 28 May 2003 07:46:26 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-02.txt Pages : 6 Date : 2003-5-27 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-02.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-02.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Wed May 28 14:42:36 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgaAF069039 for ; Wed, 28 May 2003 14:42:36 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SLgaLI069038 for ietf-sasl-bks; Wed, 28 May 2003 14:42:36 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (KONISHI-POLIS.MIT.EDU [18.18.3.10]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgZAF069032 for ; Wed, 28 May 2003 14:42:35 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id 950E8151F04; Wed, 28 May 2003 17:42:37 -0400 (EDT) To: ietf-sasl@imc.org Subject: less than One week left on plain last call Message-Id: <20030528214237.950E8151F04@konishi-polis.mit.edu> Date: Wed, 28 May 2003 17:42:37 -0400 (EDT) From: hartmans@mit.edu (Sam Hartman) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Just a reminder that the plain last call ends next Monday, June 2. --Sam From owner-ietf-sasl Fri May 30 04:15:49 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFnAF021389 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4UBFn3n021388 for ietf-sasl-bks; Fri, 30 May 2003 04:15:49 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFmAF021383 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28623; Fri, 30 May 2003 07:15:46 -0400 (EDT) Message-Id: <200305301115.HAA28623@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2831bis-01.txt Date: Fri, 30 May 2003 07:15:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Using Digest Authentication as a SASL Mechanism Author(s) : P. Leach, C. Newman, A. Melnikov Filename : draft-ietf-sasl-rfc2831bis-01.txt Pages : 37 Date : 2003-5-29 This specification defines how HTTP Digest Authentication [Digest] can be used as a SASL [RFC 2222] mechanism for any protocol that has a SASL profile. It is intended both as an improvement over CRAM-MD5 [RFC 2195] and as a convenient way to support a single authentication mechanism for web, mail, LDAP, and other protocols. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2831bis-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2831bis-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Fri May 30 20:07:31 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37VAF065120 for ; Fri, 30 May 2003 20:07:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V37VqN065119 for ietf-sasl-bks; Fri, 30 May 2003 20:07:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37UAF065114 for ; Fri, 30 May 2003 20:07:30 -0700 (PDT) (envelope-from Chris.Newman@Sun.COM) Received: from esunmail ([129.147.58.120]) by brmea-mail-2.sun.com (8.12.9/8.12.9) with ESMTP id h4V37XYU010291 for ; Fri, 30 May 2003 21:07:33 -0600 (MDT) Received: from xpa-fe1 ([129.147.58.198]) by edgemail1.Central.Sun.COM (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTP id <0HFQ00FBGDYO1M@edgemail1.Central.Sun.COM> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:25 -0600 (MDT) Received: from nifty-jr.west.sun.com ([129.153.12.95]) by mail.sun.net (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTPSA id <0HFQ00KHYDYLM1@mail.sun.net> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:24 -0600 (MDT) Date: Fri, 30 May 2003 20:03:25 -0700 From: Chris Newman Subject: Re: Last Call for draft-ietf-sasl-plain-01 In-reply-to: To: Sam Hartman , ietf-sasl@imc.org, Kurt Zeilenga Message-id: <2147483647.1054325005@nifty-jr.west.sun.com> MIME-version: 1.0 X-Mailer: Mulberry/3.0.3 (Mac OS X) Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-message-flag: Outlook: the best virus distribution system around References: Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is mostly editorial nits, but a few substantive issues are included. ----- > This document defines a simple clear-text user/password Simple > Authentication and Security Layer (SASL) mechanism called the PLAIN > mechanism. The PLAIN mechanism intended to be used, in combination ^ is ----- I suggest adding a reference that would make sense to a broader audience: > This document defines the PLAIN Simple Authentication and Security > Layer ([SASL]) mechanism for use in protocols with no clear-text login > command (e.g., [ACAP]). ^ or [SMTP-AUTH] [SMTP-AUTH] J. Myers, "SMTP Service Extension for Authentication", RFC 2554, March 1999. ----- > The PLAIN SASL mechanism MUST NOT be advertised unless a strong > encryption layer, such as provided by Transport Layer Security > ([TLS]), is active. ^ or backwards compatibility dictates otherwise. I _STRONGLY_ object to this substantive change from RFC 2595 which was not listed in the appendix. There are deployed SMTP AUTH clients which use PLAIN without TLS and I need to interoperate with them. If you drop the backwards compatibility phrase, I will refuse to comply with this version of the PLAIN mechanism and encourage others to do the same (which would be a shame if we want SASLprep to deploy). If you can't tolerate the phrasing of the text from RFC 2595, then I recommend using text similar to that in RFC 3501 sec 11.2: which is stronger but still realistic. I'm all for improving the security of the Internet, but I have to draw the line at requirements which fail to reflect reality. IETF specifications only have value if implementers can comply with them and still interoperate with the majority of deployed software. ----- > character, followed by the clear-text password. The client leaves > the authorization identity empty if wishes the server to derive the ^ it ----- > It is noted that the > UTF-8 encoding of a Unicode character may be as long as 6 octets. I believe this is incorrect. Unicode characters range from U+0000 to U+10FFFF (if I recall correctly). The largest Unicode character consumes only 4 octets in UTF-8. ----- > Upon receipt of the message, the server will verify presented ^ the > authentication identity (authcid) and password (passwd) with the > system authentication database and that the authentication credentials ^^^^ verify > permit the client to login as the (presented or derived) authorization > identity. If both steps succeed, the user is authenticated. ----- > The presented authentication identity and password strings are not be ^ to > compared directly with stored strings. The server SHALL first prepare > authentication identity strings and password strings using the XXXXXXX > [SASLPrep] profile of the [StringPrep] algorithm. If preparation ----- > stronger SASL mechanisms such as the Kerberos-based GSSAPI mechanism If you mention it, you need to include an informative reference. ----- > address this issue. Clients are encouraged to have an operational > mode where all mechanisms which are likely to reveal the user's > password to the server are disabled. It is RECOMMENDED that this mode > be the default. I object to the addition of the last sentence (which was not in RFC 2595). Such a default mode would mean the client would not interoperate with about 95% of deployed servers on the Internet. Please remove it as it is not realistic. ----- > "stringprep" and Unicode security considerations also apply. Please include references. If I'm trying to review all the security considerations that apply I need to be able to find them. The security considerations for UTF-8 also apply. ----- Person & email address to contact for further information: Kurt Zeilenga > Chris Neuman Please remove me from this registration. You might want to put the address of the ietf-sasl mailing list as the contact address for more information. ----- > This document is a revision of RFC 2595 by Chris Newman. Portions of > the grammar defined in Section 2 were borrowed from [UTF-8] by > Francois Yergeau. I wrote the grammar in Yergeau's revised document :-) ----- [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998. Please change this to reference the working draft, which has the revised security considerations. [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", draft-yergeau-rfc2279bis-04 (work in progress), February 2003. ----- - Chris From owner-ietf-sasl Fri May 30 21:45:39 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jdAF068781 for ; Fri, 30 May 2003 21:45:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V4jdXl068780 for ietf-sasl-bks; Fri, 30 May 2003 21:45:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jcAF068775 for ; Fri, 30 May 2003 21:45:38 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4V4jfc6054596; Sat, 31 May 2003 04:45:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030530212030.02a25948@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 30 May 2003 21:42:46 -0700 To: Chris Newman From: "Kurt D. Zeilenga" Subject: Re: Last Call for draft-ietf-sasl-plain-01 Cc: Sam Hartman , ietf-sasl@imc.org In-Reply-To: <2147483647.1054325005@nifty-jr.west.sun.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Chris, I concur with your comments. At 08:03 PM 5/30/2003, Chris Newman wrote: > The PLAIN SASL mechanism MUST NOT be advertised unless a strong >> encryption layer, such as provided by Transport Layer Security >> ([TLS]), is active. > ^ > or backwards compatibility dictates otherwise. An error on my part. It should be same as the text in the Security Considerations section. Kurt From owner-ietf-sasl Tue May 6 04:46:17 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkGi2066614 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BkGkN066613 for ietf-sasl-bks; Tue, 6 May 2003 04:46:16 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkFi2066608 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15357; Tue, 6 May 2003 07:43:18 -0400 (EDT) Message-Id: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-plain-01.txt Date: Tue, 06 May 2003 07:43:18 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Plain SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt Pages : 8 Date : 2003-5-5 This document defines a simple clear-text user/password Simple Authentication and Security Layer (SASL) mechanism called the PLAIN mechanism. The PLAIN mechanism intended to be used, in combination with data confidentiality services provided by a lower layer, in protocols which lack a simple password authentication command. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-plain-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-plain-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-plain-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-plain-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-plain-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 04:44:44 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Biii2066558 for ; Tue, 6 May 2003 04:44:44 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BiiSf066557 for ietf-sasl-bks; Tue, 6 May 2003 04:44:44 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bihi2066551 for ; Tue, 6 May 2003 04:44:43 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15295; Tue, 6 May 2003 07:41:46 -0400 (EDT) Message-Id: <200305061141.HAA15295@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-anon-01.txt Date: Tue, 06 May 2003 07:41:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Anonymous SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-anon-01.txt Pages : 8 Date : 2003-5-5 It is common practice on the Internet to permit anonymous access to various services. Traditionally, this has been done with a plain text password mechanism using 'anonymous' as the user name and optional trace information, such as an email address, as the password. As plaintext login commands are not permitted in new IETF protocols, a new way to provide anonymous login is needed within the context of the Simple Authentication and Security Layer (SASL) framework. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-anon-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-anon-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-anon-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-anon-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-anon-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 04:44:39 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bidi2066545 for ; Tue, 6 May 2003 04:44:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BidJx066544 for ietf-sasl-bks; Tue, 6 May 2003 04:44:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bici2066539 for ; Tue, 6 May 2003 04:44:38 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15279; Tue, 6 May 2003 07:41:41 -0400 (EDT) Message-Id: <200305061141.HAA15279@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-01.txt Date: Tue, 06 May 2003 07:41:41 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-01.txt Pages : 5 Date : 2003-5-5 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Tue May 6 07:42:41 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egfi2080227 for ; Tue, 6 May 2003 07:42:41 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EgfAd080226 for ietf-sasl-bks; Tue, 6 May 2003 07:42:41 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egei2080221 for ; Tue, 6 May 2003 07:42:40 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46Egfc6009677 for ; Tue, 6 May 2003 14:42:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506073836.02c7b3e8@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:40:12 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: PLAIN In-Reply-To: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-plain based upon list and off-list comments. Please review and comment. From owner-ietf-sasl Tue May 6 07:43:31 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhVi2080249 for ; Tue, 6 May 2003 07:43:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EhVxT080248 for ietf-sasl-bks; Tue, 6 May 2003 07:43:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhUi2080243 for ; Tue, 6 May 2003 07:43:30 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46EhVc6009682 for ; Tue, 6 May 2003 14:43:31 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506074017.02c84be0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:41:02 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: SASLprep Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-saslprep based upon list and off-list comment. Please review and comment. Thanks, Kurt From owner-ietf-sasl Sat May 17 12:16:27 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGRAF092906 for ; Sat, 17 May 2003 12:16:27 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HJGRUu092905 for ietf-sasl-bks; Sat, 17 May 2003 12:16:27 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGQAF092900 for ; Sat, 17 May 2003 12:16:26 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id AE804152451; Sat, 17 May 2003 15:12:42 -0400 (EDT) To: ietf-sasl@imc.org Subject: Last Call for draft-ietf-sasl-plain-01 From: Sam Hartman Date: Sat, 17 May 2003 15:12:42 -0400 Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This message initiates a SASL Working Group Last Call on the document: Title : The Plain SASL Mechanism Editor : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt The purpose of this WG Last Call is to ensure that the Working Group has achieved consensus that the document is suitable for publication as a Proposed Standard. Please review the document for both technical and editorial problems. Technical issues should be discussed on this list. Editorial issues may be sent to the document editor. The Last Call period will end on Monday, June 2, 2003. Upon completion of the last call, the WG chair(s) will take action based upon the consensus of the WG. Possible actions include: 1) recommending to the IETF Security Area Directors that the document, after possible editorial or other minor changes, be considered by the IESG for publication as a Standard Track RFC (which generally involves an IETF-wide Last Call); or 2) requiring that outstanding issues be adequately addressed prior to further action (including, possibly, another WG Last Call). Remember that it is our responsibility as Working Group members to ensure the quality of our documents and of the Internet Standards process. So, please read and comment! - Sam Hartman SASL co-chair From owner-ietf-sasl Sat May 17 14:02:25 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2PAF096888 for ; Sat, 17 May 2003 14:02:25 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HL2PZf096887 for ietf-sasl-bks; Sat, 17 May 2003 14:02:25 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from yxa.extundo.com (178.230.13.217.in-addr.dgcsystems.net [217.13.230.178]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2NAF096881 for ; Sat, 17 May 2003 14:02:24 -0700 (PDT) (envelope-from jas@extundo.com) Received: from latte-wlan.josefsson.org (yxa.extundo.com [217.13.230.178]) (authenticated bits=0) by yxa.extundo.com (8.12.9/8.12.9) with ESMTP id h4HL2IB4004454 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=OK) for ; Sat, 17 May 2003 23:02:18 +0200 To: ietf-sasl@imc.org Subject: Comments on draft-ietf-sasl-plain-01.txt From: Simon Josefsson X-Payment: hashcash 1.2 0:030517:ietf-sasl@imc.org:89c03113bd990658 X-Hashcash: 0:030517:ietf-sasl@imc.org:89c03113bd990658 Date: Sat, 17 May 2003 23:02:18 +0200 Message-ID: User-Agent: Gnus/5.1003 (Gnus v5.10.3) Emacs/21.3.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Status: No, hits=-6.3 required=5.0 tests=USER_AGENT_GNUS_UA autolearn=ham version=2.50 X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: The server MAY also use the password to initialize any new authentication database, such as one suitable for [CRAM-MD5] or [DIGEST-MD5]. First, DIGEST-MD5 need authcid and authzid too, it isn't possible to initialize a hashed password database suitable for DIGEST-MD5 using the password only. Secondly, how will this interact with the non-ASCII handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN server SASLprep() the strings or not, before hashing them and storing them in the database, for later use with *-MD5? The answer appears to depend on how *-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis does not currently mention SASLprep. Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque data except SPC?), it would be prudent to mention in the security considerations that if someone currently uses non-ASCII usernames in PLAIN, the SASLprep() operation may cause changes to the username. This warning may be more appropriate in the saslprep document, but that document doesn't have a security consideration currently. E.g., if someone has a system with two users "foo" and "fooss", the SASLprep() operation translates the first string into the latter before database comparison, whereas the application does not necessarily perform the same translation. The consequences appears to be that someone who knows the password for "fooss" may also be authenticated as "foo". Thanks. From owner-ietf-sasl Sat May 17 14:30:59 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUxAF097406 for ; Sat, 17 May 2003 14:30:59 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HLUxXo097405 for ietf-sasl-bks; Sat, 17 May 2003 14:30:59 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUwAF097400 for ; Sat, 17 May 2003 14:30:58 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id BF5C3152451; Sat, 17 May 2003 17:26:53 -0400 (EDT) To: Simon Josefsson Cc: ietf-sasl@imc.org Subject: Re: Comments on draft-ietf-sasl-plain-01.txt References: From: Sam Hartman Date: Sat, 17 May 2003 17:26:53 -0400 In-Reply-To: (Simon Josefsson's message of "Sat, 17 May 2003 23:02:18 +0200") Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: >>>>> "Simon" == Simon Josefsson writes: Simon> Secondly, how will this interact with the non-ASCII Simon> handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN Simon> server SASLprep() the strings or not, before hashing them Simon> and storing them in the database, for later use with *-MD5? Simon> The answer appears to depend on how *-MD5bis will handle Simon> non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis Simon> does not currently mention SASLprep. We agreed in San Francisco that digest-md5 would use saslprep. I believe we agreed the same for cram-md5. Those updates are pending. --Sam From owner-ietf-sasl Sun May 18 09:26:04 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ3AF062595 for ; Sun, 18 May 2003 09:26:04 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4IGQ3j2062594 for ietf-sasl-bks; Sun, 18 May 2003 09:26:03 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ2AF062589 for ; Sun, 18 May 2003 09:26:02 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4IGPnc6030201; Sun, 18 May 2003 16:25:50 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030518085943.02780fc0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sun, 18 May 2003 09:23:05 -0700 To: Simon Josefsson From: "Kurt D. Zeilenga" Subject: Re: Comments on draft-ietf-sasl-plain-01.txt Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: At 02:02 PM 5/17/2003, Simon Josefsson wrote: > The server MAY also use the password to initialize any new > authentication database, such as one suitable for [CRAM-MD5] or > [DIGEST-MD5]. > >First, DIGEST-MD5 need authcid and authzid too, Technically speaking, the DIGEST-MD5 A1 hash doesn't include the authzid. >it isn't possible to >initialize a hashed password database suitable for DIGEST-MD5 using >the password only. I'll s/password/credentials/ in the above. >Secondly, how will this interact with the non-ASCII handling in >CRAM-MD5 and DIGEST-MD5? I think that exactly how PLAIN credentials interact with credentials of other mechanisms should be viewed as an implementation detail as the syntax and semantics of those credentials is mechanism specific. But as Sam said, I think the WG intends to use SASLprep for all username and password appearing in such mechanisms. >Should the PLAIN server SASLprep() the >strings or not, before hashing them and storing them in the database, >for later use with *-MD5? The answer appears to depend on how >*-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and >DIGEST-MD5bis does not currently mention SASLprep. > >Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque >data except SPC?), it would be prudent to mention in the security >considerations that if someone currently uses non-ASCII usernames in >PLAIN, the SASLprep() operation may cause changes to the username. >This warning may be more appropriate in the saslprep document, but >that document doesn't have a security consideration currently. E.g., >if someone has a system with two users "foo" and >"fooss", the SASLprep() operation translates the first string into the >latter before database comparison, whereas the application does not >necessarily perform the same translation. The consequences appears to >be that someone who knows the password for "fooss" may also be >authenticated as "foo". Well, saslprep should have a security consideration section. I think it fine to elaborate that the profile as to why it is not intended to be applied to identities which are not simple user names and related issued. Also, I think 2222bis should be more clear that the form which authentication credentials take and how they are used to authenticate the user is mechanism specific. Applications should be avoid overloading syntax and semantics. I don't see the PLAIN I-D needing any additional text here. Kurt From owner-ietf-sasl Wed May 21 05:11:02 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB2AF022972 for ; Wed, 21 May 2003 05:11:02 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4LCB2fG022971 for ietf-sasl-bks; Wed, 21 May 2003 05:11:02 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB1AF022966 for ; Wed, 21 May 2003 05:11:01 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16130; Wed, 21 May 2003 08:11:01 -0400 (EDT) Message-Id: <200305211211.IAA16130@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2222bis-00.txt Date: Wed, 21 May 2003 08:11:00 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Simple Authentication and Security Layer (SASL) Author(s) : A. Melnikov Filename : draft-ietf-sasl-rfc2222bis-00.txt Pages : 18 Date : 2003-5-20 SASL provides a method for adding authentication support with an optional security layer to connection-based protocols. It also describes a structure for authentication mechanisms. The result is an abstraction layer between protocols and authentication mechanisms such that any SASL-compatible authentication mechanism can be used with any SASL-compatible protocol. This document describes how a SASL authentication mechanism is structured, how a protocol adds support for SASL, defines the protocol for carrying a security layer over a connection, and defines the EXTERNAL SASL authentication mechanism. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2222bis-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2222bis-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Wed May 21 06:18:04 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LDI4AF027882 for ; Wed, 21 May 2003 06:18:04 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4LDI4Ik027881 for ietf-sasl-bks; Wed, 21 May 2003 06:18:04 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from db1.contentcatcher.com ([64.19.188.18]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LDI3AF027870 for ; Wed, 21 May 2003 06:18:04 -0700 (PDT) (envelope-from Internet-Drafts@ietf.org) Received: from CC2 ([192.168.200.3]) by db1.contentcatcher.com with Microsoft SMTPSVC(5.0.2195.5329); Wed, 21 May 2003 09:14:25 -0400 x-sender: owner-ietf-announce@ietf.org x-receiver: spamtrap@spam.clearnetwork.com Received: from pf1.contentcatcher.com ([192.168.100.2]) by CC2 with Microsoft SMTPSVC(5.0.2195.5329); Wed, 21 May 2003 09:18:47 -0400 Received: by pf1.contentcatcher.com (Postfix, from userid 502) id 2D9709F615; Wed, 21 May 2003 09:04:14 -0400 (EDT) Received: from asgard.ietf.org (asgard.ietf.org [132.151.6.40]) by pf1.contentcatcher.com (Postfix) with ESMTP id 269179F612; Wed, 21 May 2003 09:04:07 -0400 (EDT) Received: from majordomo by asgard.ietf.org with local (Exim 4.14) id 19ISTg-0003Yc-DN for ietf-announce-list@asgard.ietf.org; Wed, 21 May 2003 08:13:52 -0400 Received: from odin.ietf.org ([10.27.2.28] helo=ietf.org) by asgard.ietf.org with esmtp (Exim 4.14) id 19ISQx-0003V2-2n for all-ietf@asgard.ietf.org; Wed, 21 May 2003 08:11:03 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16130; Wed, 21 May 2003 08:11:01 -0400 (EDT) Message-Id: <200305211211.IAA16130@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" Reply-To: Internet-Drafts@ietf.org Date: Wed, 21 May 2003 08:11:00 -0400 X-Spam-Status: Yes, hits=10.6 required=5.0tests=BAYES_80,CC_Bulk_Header_1,MIME_BOUND_NEXTPART,TO_MALFORMEDversion=2.53-contentcatcher X-Spam-Level: ********** X-Spam-Checker-Version: SpamAssassin 2.53-contentcatcher (1.174.2.15-2003-03-30-exp) X-Spam-Report: ---- Start SpamAssassin results10.60 points, 5 required;* 1.8 -- To: has a malformed address* 5.0 -- Mail has precedence set to bulk* 3.5 -- BODY: Bayesian classifier says spam probability is 80 to 90%[score: 0.8048]* 0.3 -- Spam tool pattern in MIME boundary---- End of SpamAssassin results X-Spam-Flag: YES X-VIRUS-FOUND: NO X-GHOST-SENDER: owner-ietf-announce@ietf.org X-GHOST-RECEIVER: braja@tellium.com X-OriginalArrivalTime: 21 May 2003 13:18:47.0500 (UTC) FILETIME=[830460C0:01C31F9B] x-contentCatcher: ContentCatcher build 0407021738 Cc: ietf-sasl@imc.org To: braja@tellium.com From: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2222bis-00.txt [owner-ietf-announce@ietf.org in Pass-Through List] ['from' in Pass-Through List] Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is a multi-part message in MIME format. --NextPart Title : Simple Authentication and Security Layer (SASL) Author(s) : A. Melnikov Filename : draft-ietf-sasl-rfc2222bis-00.txt Pages : 18 Date : 2003-5-20 SASL provides a method for adding authentication support with an optional security layer to connection-based protocols. It also describes a structure for authentication mechanisms. The result is an abstraction layer between protocols and authentication mechanisms such that any SASL-compatible authentication mechanism can be used with any SASL-compatible protocol. This document describes how a SASL authentication mechanism is structured, how a protocol adds support for SASL, defines the protocol for carrying a security layer over a connection, and defines the EXTERNAL SASL authentication mechanism. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2222bis-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" This is a multi-part message in MIME format. --OtherAccess Content-Type: Message/External-body;access-type="mail-server";server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt --OtherAccess Content-Type: Message/External-body;name="draft-ietf-sasl-rfc2222bis-00.txt";site="ftp.ietf.org";access-type="anon-ftp";directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Fri May 23 10:51:35 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpZAF036698 for ; Fri, 23 May 2003 10:51:35 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4NHpZZg036697 for ietf-sasl-bks; Fri, 23 May 2003 10:51:35 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from urchi.cc.columbia.edu (IDENT:cu41754@urchi.cc.columbia.edu [128.59.31.94]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpXAF036692 for ; Fri, 23 May 2003 10:51:34 -0700 (PDT) (envelope-from giorgi@columbia.edu) Received: from urchi.cc.columbia.edu (localhost [127.0.0.1]) by urchi.cc.columbia.edu (8.12.8/8.12.3) with ESMTP id h4NHpXu1022791 for ; Fri, 23 May 2003 13:51:33 -0400 (EDT) Received: from localhost (giorgi@localhost) by urchi.cc.columbia.edu (8.12.8/8.12.8/Submit) with ESMTP id h4NHpWKj022788 for ; Fri, 23 May 2003 13:51:32 -0400 (EDT) X-Authentication-Warning: urchi.cc.columbia.edu: giorgi owned process doing -bs Date: Fri, 23 May 2003 13:51:32 -0400 (EDT) From: Giorgi Lebanidze To: ietf-sasl@imc.org Subject: problems with using CRAM-MD5 Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: First of all I appologize if this is not teh way I was supposed to contact other subscribers of the list. I'm new to the group. I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call returns SASL_NOUSER -20 /* user not found */. Where does the SASL library look for the users and passwords while authenticating with CRAM-MD5 ? thanks, Giorgi From owner-ietf-sasl Fri May 23 19:00:14 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20DAF052576 for ; Fri, 23 May 2003 19:00:13 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4O20Djl052575 for ietf-sasl-bks; Fri, 23 May 2003 19:00:13 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20CAF052569 for ; Fri, 23 May 2003 19:00:12 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4O209c6084847; Sat, 24 May 2003 02:00:10 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030523185024.0278b740@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 23 May 2003 18:57:22 -0700 To: Giorgi Lebanidze From: "Kurt D. Zeilenga" Subject: Re: problems with using CRAM-MD5 Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I note that the purpose of this list is to discuss the standardization of SASL. Specifically, this list is the home of the IETF SASL WG. Your post seems more appropriate to a list supporting the particular implementation you are using. I suspect you are trying to use the Cyrus SASL library from CMU. If so, you should direct your questions to the mailing list. Regards, Kurt (SASL WG co-chair) At 10:51 AM 5/23/2003, Giorgi Lebanidze wrote: >First of all I appologize if this is not teh way I was supposed to contact >other subscribers of the list. I'm new to the group. You just did contact everyone on the list. >I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 >mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call >returns SASL_NOUSER -20 /* user not found */. Where does the SASL library >look for the users and passwords while authenticating with CRAM-MD5 ? >thanks, >Giorgi From owner-ietf-sasl Tue May 27 02:31:34 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4R9VYAF035725 for ; Tue, 27 May 2003 02:31:34 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4R9VYXt035724 for ietf-sasl-bks; Tue, 27 May 2003 02:31:34 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from fmx4.freemail.hu (fmx4.freemail.hu [195.228.242.224]) by above.proper.com (8.12.9/8.12.8) with SMTP id h4R9VVAF035719 for ; Tue, 27 May 2003 02:31:32 -0700 (PDT) (envelope-from kovacspeter2@freemail.hu) Received: (qmail 73645 invoked from network); 27 May 2003 11:31:31 +0200 Received: from fm3.freemail.hu (195.228.242.203) by fmx4.freemail.hu with SMTP; 27 May 2003 11:31:31 +0200 Received: (qmail 19996 invoked by uid 3421979); 27 May 2003 11:30:15 +0200 Date: Tue, 27 May 2003 11:30:15 +0200 (CEST) From: =?ISO-8859-2?Q?Kov=E1cs_P=E9ter?= Subject: mux.pid To: ietf-sasl@imc.org Message-ID: X-Originating-IP: [81.182.49.222] X-HTTP-User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-2 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Hello, I have a system running FreeBSD 4.8. After running the make world the following error come up in the /var/log/messages file: saslauthd[296]: FATAL: setting master lock on /var/state/saslauthd/mux.pid: Resource temporarily unavailable I recompiled the whole sasl2, but the error still exist. And of course the file exsits as well. It has a number inside. Thanks... From owner-ietf-sasl Wed May 28 04:46:28 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkSAF038205 for ; Wed, 28 May 2003 04:46:28 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SBkSTm038204 for ietf-sasl-bks; Wed, 28 May 2003 04:46:28 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkQAF038199 for ; Wed, 28 May 2003 04:46:27 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA25718; Wed, 28 May 2003 07:46:26 -0400 (EDT) Message-Id: <200305281146.HAA25718@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-02.txt Date: Wed, 28 May 2003 07:46:26 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-02.txt Pages : 6 Date : 2003-5-27 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-02.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-02.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Wed May 28 14:42:36 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgaAF069039 for ; Wed, 28 May 2003 14:42:36 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SLgaLI069038 for ietf-sasl-bks; Wed, 28 May 2003 14:42:36 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (KONISHI-POLIS.MIT.EDU [18.18.3.10]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgZAF069032 for ; Wed, 28 May 2003 14:42:35 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id 950E8151F04; Wed, 28 May 2003 17:42:37 -0400 (EDT) To: ietf-sasl@imc.org Subject: less than One week left on plain last call Message-Id: <20030528214237.950E8151F04@konishi-polis.mit.edu> Date: Wed, 28 May 2003 17:42:37 -0400 (EDT) From: hartmans@mit.edu (Sam Hartman) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Just a reminder that the plain last call ends next Monday, June 2. --Sam From owner-ietf-sasl Fri May 30 04:15:49 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFnAF021389 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4UBFn3n021388 for ietf-sasl-bks; Fri, 30 May 2003 04:15:49 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFmAF021383 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28623; Fri, 30 May 2003 07:15:46 -0400 (EDT) Message-Id: <200305301115.HAA28623@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2831bis-01.txt Date: Fri, 30 May 2003 07:15:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Using Digest Authentication as a SASL Mechanism Author(s) : P. Leach, C. Newman, A. Melnikov Filename : draft-ietf-sasl-rfc2831bis-01.txt Pages : 37 Date : 2003-5-29 This specification defines how HTTP Digest Authentication [Digest] can be used as a SASL [RFC 2222] mechanism for any protocol that has a SASL profile. It is intended both as an improvement over CRAM-MD5 [RFC 2195] and as a convenient way to support a single authentication mechanism for web, mail, LDAP, and other protocols. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2831bis-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2831bis-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-ietf-sasl Fri May 30 20:07:31 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37VAF065120 for ; Fri, 30 May 2003 20:07:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V37VqN065119 for ietf-sasl-bks; Fri, 30 May 2003 20:07:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37UAF065114 for ; Fri, 30 May 2003 20:07:30 -0700 (PDT) (envelope-from Chris.Newman@Sun.COM) Received: from esunmail ([129.147.58.120]) by brmea-mail-2.sun.com (8.12.9/8.12.9) with ESMTP id h4V37XYU010291 for ; Fri, 30 May 2003 21:07:33 -0600 (MDT) Received: from xpa-fe1 ([129.147.58.198]) by edgemail1.Central.Sun.COM (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTP id <0HFQ00FBGDYO1M@edgemail1.Central.Sun.COM> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:25 -0600 (MDT) Received: from nifty-jr.west.sun.com ([129.153.12.95]) by mail.sun.net (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTPSA id <0HFQ00KHYDYLM1@mail.sun.net> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:24 -0600 (MDT) Date: Fri, 30 May 2003 20:03:25 -0700 From: Chris Newman Subject: Re: Last Call for draft-ietf-sasl-plain-01 In-reply-to: To: Sam Hartman , ietf-sasl@imc.org, Kurt Zeilenga Message-id: <2147483647.1054325005@nifty-jr.west.sun.com> MIME-version: 1.0 X-Mailer: Mulberry/3.0.3 (Mac OS X) Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-message-flag: Outlook: the best virus distribution system around References: Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is mostly editorial nits, but a few substantive issues are included. ----- > This document defines a simple clear-text user/password Simple > Authentication and Security Layer (SASL) mechanism called the PLAIN > mechanism. The PLAIN mechanism intended to be used, in combination ^ is ----- I suggest adding a reference that would make sense to a broader audience: > This document defines the PLAIN Simple Authentication and Security > Layer ([SASL]) mechanism for use in protocols with no clear-text login > command (e.g., [ACAP]). ^ or [SMTP-AUTH] [SMTP-AUTH] J. Myers, "SMTP Service Extension for Authentication", RFC 2554, March 1999. ----- > The PLAIN SASL mechanism MUST NOT be advertised unless a strong > encryption layer, such as provided by Transport Layer Security > ([TLS]), is active. ^ or backwards compatibility dictates otherwise. I _STRONGLY_ object to this substantive change from RFC 2595 which was not listed in the appendix. There are deployed SMTP AUTH clients which use PLAIN without TLS and I need to interoperate with them. If you drop the backwards compatibility phrase, I will refuse to comply with this version of the PLAIN mechanism and encourage others to do the same (which would be a shame if we want SASLprep to deploy). If you can't tolerate the phrasing of the text from RFC 2595, then I recommend using text similar to that in RFC 3501 sec 11.2: which is stronger but still realistic. I'm all for improving the security of the Internet, but I have to draw the line at requirements which fail to reflect reality. IETF specifications only have value if implementers can comply with them and still interoperate with the majority of deployed software. ----- > character, followed by the clear-text password. The client leaves > the authorization identity empty if wishes the server to derive the ^ it ----- > It is noted that the > UTF-8 encoding of a Unicode character may be as long as 6 octets. I believe this is incorrect. Unicode characters range from U+0000 to U+10FFFF (if I recall correctly). The largest Unicode character consumes only 4 octets in UTF-8. ----- > Upon receipt of the message, the server will verify presented ^ the > authentication identity (authcid) and password (passwd) with the > system authentication database and that the authentication credentials ^^^^ verify > permit the client to login as the (presented or derived) authorization > identity. If both steps succeed, the user is authenticated. ----- > The presented authentication identity and password strings are not be ^ to > compared directly with stored strings. The server SHALL first prepare > authentication identity strings and password strings using the XXXXXXX > [SASLPrep] profile of the [StringPrep] algorithm. If preparation ----- > stronger SASL mechanisms such as the Kerberos-based GSSAPI mechanism If you mention it, you need to include an informative reference. ----- > address this issue. Clients are encouraged to have an operational > mode where all mechanisms which are likely to reveal the user's > password to the server are disabled. It is RECOMMENDED that this mode > be the default. I object to the addition of the last sentence (which was not in RFC 2595). Such a default mode would mean the client would not interoperate with about 95% of deployed servers on the Internet. Please remove it as it is not realistic. ----- > "stringprep" and Unicode security considerations also apply. Please include references. If I'm trying to review all the security considerations that apply I need to be able to find them. The security considerations for UTF-8 also apply. ----- Person & email address to contact for further information: Kurt Zeilenga > Chris Neuman Please remove me from this registration. You might want to put the address of the ietf-sasl mailing list as the contact address for more information. ----- > This document is a revision of RFC 2595 by Chris Newman. Portions of > the grammar defined in Section 2 were borrowed from [UTF-8] by > Francois Yergeau. I wrote the grammar in Yergeau's revised document :-) ----- [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998. Please change this to reference the working draft, which has the revised security considerations. [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", draft-yergeau-rfc2279bis-04 (work in progress), February 2003. ----- - Chris From owner-ietf-sasl Fri May 30 21:45:39 2003 Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jdAF068781 for ; Fri, 30 May 2003 21:45:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V4jdXl068780 for ietf-sasl-bks; Fri, 30 May 2003 21:45:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jcAF068775 for ; Fri, 30 May 2003 21:45:38 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4V4jfc6054596; Sat, 31 May 2003 04:45:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030530212030.02a25948@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 30 May 2003 21:42:46 -0700 To: Chris Newman From: "Kurt D. Zeilenga" Subject: Re: Last Call for draft-ietf-sasl-plain-01 Cc: Sam Hartman , ietf-sasl@imc.org In-Reply-To: <2147483647.1054325005@nifty-jr.west.sun.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Chris, I concur with your comments. At 08:03 PM 5/30/2003, Chris Newman wrote: > The PLAIN SASL mechanism MUST NOT be advertised unless a strong >> encryption layer, such as provided by Transport Layer Security >> ([TLS]), is active. > ^ > or backwards compatibility dictates otherwise. An error on my part. It should be same as the text in the Security Considerations section. Kurt Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jdAF068781 for ; Fri, 30 May 2003 21:45:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V4jdXl068780 for ietf-sasl-bks; Fri, 30 May 2003 21:45:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V4jcAF068775 for ; Fri, 30 May 2003 21:45:38 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4V4jfc6054596; Sat, 31 May 2003 04:45:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030530212030.02a25948@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 30 May 2003 21:42:46 -0700 To: Chris Newman From: "Kurt D. Zeilenga" Subject: Re: Last Call for draft-ietf-sasl-plain-01 Cc: Sam Hartman , ietf-sasl@imc.org In-Reply-To: <2147483647.1054325005@nifty-jr.west.sun.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Chris, I concur with your comments. At 08:03 PM 5/30/2003, Chris Newman wrote: > The PLAIN SASL mechanism MUST NOT be advertised unless a strong >> encryption layer, such as provided by Transport Layer Security >> ([TLS]), is active. > ^ > or backwards compatibility dictates otherwise. An error on my part. It should be same as the text in the Security Considerations section. Kurt Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37VAF065120 for ; Fri, 30 May 2003 20:07:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4V37VqN065119 for ietf-sasl-bks; Fri, 30 May 2003 20:07:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4V37UAF065114 for ; Fri, 30 May 2003 20:07:30 -0700 (PDT) (envelope-from Chris.Newman@Sun.COM) Received: from esunmail ([129.147.58.120]) by brmea-mail-2.sun.com (8.12.9/8.12.9) with ESMTP id h4V37XYU010291 for ; Fri, 30 May 2003 21:07:33 -0600 (MDT) Received: from xpa-fe1 ([129.147.58.198]) by edgemail1.Central.Sun.COM (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTP id <0HFQ00FBGDYO1M@edgemail1.Central.Sun.COM> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:25 -0600 (MDT) Received: from nifty-jr.west.sun.com ([129.153.12.95]) by mail.sun.net (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with ESMTPSA id <0HFQ00KHYDYLM1@mail.sun.net> for ietf-sasl@imc.org; Fri, 30 May 2003 21:06:24 -0600 (MDT) Date: Fri, 30 May 2003 20:03:25 -0700 From: Chris Newman Subject: Re: Last Call for draft-ietf-sasl-plain-01 In-reply-to: To: Sam Hartman , ietf-sasl@imc.org, Kurt Zeilenga Message-id: <2147483647.1054325005@nifty-jr.west.sun.com> MIME-version: 1.0 X-Mailer: Mulberry/3.0.3 (Mac OS X) Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-message-flag: Outlook: the best virus distribution system around References: Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is mostly editorial nits, but a few substantive issues are included. ----- > This document defines a simple clear-text user/password Simple > Authentication and Security Layer (SASL) mechanism called the PLAIN > mechanism. The PLAIN mechanism intended to be used, in combination ^ is ----- I suggest adding a reference that would make sense to a broader audience: > This document defines the PLAIN Simple Authentication and Security > Layer ([SASL]) mechanism for use in protocols with no clear-text login > command (e.g., [ACAP]). ^ or [SMTP-AUTH] [SMTP-AUTH] J. Myers, "SMTP Service Extension for Authentication", RFC 2554, March 1999. ----- > The PLAIN SASL mechanism MUST NOT be advertised unless a strong > encryption layer, such as provided by Transport Layer Security > ([TLS]), is active. ^ or backwards compatibility dictates otherwise. I _STRONGLY_ object to this substantive change from RFC 2595 which was not listed in the appendix. There are deployed SMTP AUTH clients which use PLAIN without TLS and I need to interoperate with them. If you drop the backwards compatibility phrase, I will refuse to comply with this version of the PLAIN mechanism and encourage others to do the same (which would be a shame if we want SASLprep to deploy). If you can't tolerate the phrasing of the text from RFC 2595, then I recommend using text similar to that in RFC 3501 sec 11.2: which is stronger but still realistic. I'm all for improving the security of the Internet, but I have to draw the line at requirements which fail to reflect reality. IETF specifications only have value if implementers can comply with them and still interoperate with the majority of deployed software. ----- > character, followed by the clear-text password. The client leaves > the authorization identity empty if wishes the server to derive the ^ it ----- > It is noted that the > UTF-8 encoding of a Unicode character may be as long as 6 octets. I believe this is incorrect. Unicode characters range from U+0000 to U+10FFFF (if I recall correctly). The largest Unicode character consumes only 4 octets in UTF-8. ----- > Upon receipt of the message, the server will verify presented ^ the > authentication identity (authcid) and password (passwd) with the > system authentication database and that the authentication credentials ^^^^ verify > permit the client to login as the (presented or derived) authorization > identity. If both steps succeed, the user is authenticated. ----- > The presented authentication identity and password strings are not be ^ to > compared directly with stored strings. The server SHALL first prepare > authentication identity strings and password strings using the XXXXXXX > [SASLPrep] profile of the [StringPrep] algorithm. If preparation ----- > stronger SASL mechanisms such as the Kerberos-based GSSAPI mechanism If you mention it, you need to include an informative reference. ----- > address this issue. Clients are encouraged to have an operational > mode where all mechanisms which are likely to reveal the user's > password to the server are disabled. It is RECOMMENDED that this mode > be the default. I object to the addition of the last sentence (which was not in RFC 2595). Such a default mode would mean the client would not interoperate with about 95% of deployed servers on the Internet. Please remove it as it is not realistic. ----- > "stringprep" and Unicode security considerations also apply. Please include references. If I'm trying to review all the security considerations that apply I need to be able to find them. The security considerations for UTF-8 also apply. ----- Person & email address to contact for further information: Kurt Zeilenga > Chris Neuman Please remove me from this registration. You might want to put the address of the ietf-sasl mailing list as the contact address for more information. ----- > This document is a revision of RFC 2595 by Chris Newman. Portions of > the grammar defined in Section 2 were borrowed from [UTF-8] by > Francois Yergeau. I wrote the grammar in Yergeau's revised document :-) ----- [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998. Please change this to reference the working draft, which has the revised security considerations. [UTF-8] F. Yergeau, "UTF-8, a transformation format of ISO 10646", draft-yergeau-rfc2279bis-04 (work in progress), February 2003. ----- - Chris Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFnAF021389 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4UBFn3n021388 for ietf-sasl-bks; Fri, 30 May 2003 04:15:49 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4UBFmAF021383 for ; Fri, 30 May 2003 04:15:49 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28623; Fri, 30 May 2003 07:15:46 -0400 (EDT) Message-Id: <200305301115.HAA28623@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2831bis-01.txt Date: Fri, 30 May 2003 07:15:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Using Digest Authentication as a SASL Mechanism Author(s) : P. Leach, C. Newman, A. Melnikov Filename : draft-ietf-sasl-rfc2831bis-01.txt Pages : 37 Date : 2003-5-29 This specification defines how HTTP Digest Authentication [Digest] can be used as a SASL [RFC 2222] mechanism for any protocol that has a SASL profile. It is intended both as an improvement over CRAM-MD5 [RFC 2195] and as a convenient way to support a single authentication mechanism for web, mail, LDAP, and other protocols. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2831bis-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2831bis-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2831bis-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-29161918.I-D@ietf.org> --OtherAccess-- --NextPart-- Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgaAF069039 for ; Wed, 28 May 2003 14:42:36 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SLgaLI069038 for ietf-sasl-bks; Wed, 28 May 2003 14:42:36 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (KONISHI-POLIS.MIT.EDU [18.18.3.10]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SLgZAF069032 for ; Wed, 28 May 2003 14:42:35 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id 950E8151F04; Wed, 28 May 2003 17:42:37 -0400 (EDT) To: ietf-sasl@imc.org Subject: less than One week left on plain last call Message-Id: <20030528214237.950E8151F04@konishi-polis.mit.edu> Date: Wed, 28 May 2003 17:42:37 -0400 (EDT) From: hartmans@mit.edu (Sam Hartman) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Just a reminder that the plain last call ends next Monday, June 2. --Sam Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkSAF038205 for ; Wed, 28 May 2003 04:46:28 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4SBkSTm038204 for ietf-sasl-bks; Wed, 28 May 2003 04:46:28 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4SBkQAF038199 for ; Wed, 28 May 2003 04:46:27 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA25718; Wed, 28 May 2003 07:46:26 -0400 (EDT) Message-Id: <200305281146.HAA25718@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-02.txt Date: Wed, 28 May 2003 07:46:26 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-02.txt Pages : 6 Date : 2003-5-27 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-02.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-02.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-02.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-27145444.I-D@ietf.org> --OtherAccess-- --NextPart-- Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4R9VYAF035725 for ; Tue, 27 May 2003 02:31:34 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4R9VYXt035724 for ietf-sasl-bks; Tue, 27 May 2003 02:31:34 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from fmx4.freemail.hu (fmx4.freemail.hu [195.228.242.224]) by above.proper.com (8.12.9/8.12.8) with SMTP id h4R9VVAF035719 for ; Tue, 27 May 2003 02:31:32 -0700 (PDT) (envelope-from kovacspeter2@freemail.hu) Received: (qmail 73645 invoked from network); 27 May 2003 11:31:31 +0200 Received: from fm3.freemail.hu (195.228.242.203) by fmx4.freemail.hu with SMTP; 27 May 2003 11:31:31 +0200 Received: (qmail 19996 invoked by uid 3421979); 27 May 2003 11:30:15 +0200 Date: Tue, 27 May 2003 11:30:15 +0200 (CEST) From: =?ISO-8859-2?Q?Kov=E1cs_P=E9ter?= Subject: mux.pid To: ietf-sasl@imc.org Message-ID: X-Originating-IP: [81.182.49.222] X-HTTP-User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-2 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Hello, I have a system running FreeBSD 4.8. After running the make world the following error come up in the /var/log/messages file: saslauthd[296]: FATAL: setting master lock on /var/state/saslauthd/mux.pid: Resource temporarily unavailable I recompiled the whole sasl2, but the error still exist. And of course the file exsits as well. It has a number inside. Thanks... Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20DAF052576 for ; Fri, 23 May 2003 19:00:13 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4O20Djl052575 for ietf-sasl-bks; Fri, 23 May 2003 19:00:13 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4O20CAF052569 for ; Fri, 23 May 2003 19:00:12 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4O209c6084847; Sat, 24 May 2003 02:00:10 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030523185024.0278b740@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 23 May 2003 18:57:22 -0700 To: Giorgi Lebanidze From: "Kurt D. Zeilenga" Subject: Re: problems with using CRAM-MD5 Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I note that the purpose of this list is to discuss the standardization of SASL. Specifically, this list is the home of the IETF SASL WG. Your post seems more appropriate to a list supporting the particular implementation you are using. I suspect you are trying to use the Cyrus SASL library from CMU. If so, you should direct your questions to the mailing list. Regards, Kurt (SASL WG co-chair) At 10:51 AM 5/23/2003, Giorgi Lebanidze wrote: >First of all I appologize if this is not teh way I was supposed to contact >other subscribers of the list. I'm new to the group. You just did contact everyone on the list. >I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 >mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call >returns SASL_NOUSER -20 /* user not found */. Where does the SASL library >look for the users and passwords while authenticating with CRAM-MD5 ? >thanks, >Giorgi Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpZAF036698 for ; Fri, 23 May 2003 10:51:35 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4NHpZZg036697 for ietf-sasl-bks; Fri, 23 May 2003 10:51:35 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from urchi.cc.columbia.edu (IDENT:cu41754@urchi.cc.columbia.edu [128.59.31.94]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4NHpXAF036692 for ; Fri, 23 May 2003 10:51:34 -0700 (PDT) (envelope-from giorgi@columbia.edu) Received: from urchi.cc.columbia.edu (localhost [127.0.0.1]) by urchi.cc.columbia.edu (8.12.8/8.12.3) with ESMTP id h4NHpXu1022791 for ; Fri, 23 May 2003 13:51:33 -0400 (EDT) Received: from localhost (giorgi@localhost) by urchi.cc.columbia.edu (8.12.8/8.12.8/Submit) with ESMTP id h4NHpWKj022788 for ; Fri, 23 May 2003 13:51:32 -0400 (EDT) X-Authentication-Warning: urchi.cc.columbia.edu: giorgi owned process doing -bs Date: Fri, 23 May 2003 13:51:32 -0400 (EDT) From: Giorgi Lebanidze To: ietf-sasl@imc.org Subject: problems with using CRAM-MD5 Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: First of all I appologize if this is not teh way I was supposed to contact other subscribers of the list. I'm new to the group. I'm trying to integrate SASL in the server I'm writing. I'm using CRAM-MD5 mechanism and have /etc/cram-md5.pwd file. However, sasl_server_step call returns SASL_NOUSER -20 /* user not found */. Where does the SASL library look for the users and passwords while authenticating with CRAM-MD5 ? thanks, Giorgi Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB2AF022972 for ; Wed, 21 May 2003 05:11:02 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4LCB2fG022971 for ietf-sasl-bks; Wed, 21 May 2003 05:11:02 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4LCB1AF022966 for ; Wed, 21 May 2003 05:11:01 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16130; Wed, 21 May 2003 08:11:01 -0400 (EDT) Message-Id: <200305211211.IAA16130@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-rfc2222bis-00.txt Date: Wed, 21 May 2003 08:11:00 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : Simple Authentication and Security Layer (SASL) Author(s) : A. Melnikov Filename : draft-ietf-sasl-rfc2222bis-00.txt Pages : 18 Date : 2003-5-20 SASL provides a method for adding authentication support with an optional security layer to connection-based protocols. It also describes a structure for authentication mechanisms. The result is an abstraction layer between protocols and authentication mechanisms such that any SASL-compatible authentication mechanism can be used with any SASL-compatible protocol. This document describes how a SASL authentication mechanism is structured, how a protocol adds support for SASL, defines the protocol for carrying a security layer over a connection, and defines the EXTERNAL SASL authentication mechanism. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-rfc2222bis-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-rfc2222bis-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-rfc2222bis-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-20123750.I-D@ietf.org> --OtherAccess-- --NextPart-- Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ3AF062595 for ; Sun, 18 May 2003 09:26:04 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4IGQ3j2062594 for ietf-sasl-bks; Sun, 18 May 2003 09:26:03 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4IGQ2AF062589 for ; Sun, 18 May 2003 09:26:02 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h4IGPnc6030201; Sun, 18 May 2003 16:25:50 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030518085943.02780fc0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sun, 18 May 2003 09:23:05 -0700 To: Simon Josefsson From: "Kurt D. Zeilenga" Subject: Re: Comments on draft-ietf-sasl-plain-01.txt Cc: ietf-sasl@imc.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: At 02:02 PM 5/17/2003, Simon Josefsson wrote: > The server MAY also use the password to initialize any new > authentication database, such as one suitable for [CRAM-MD5] or > [DIGEST-MD5]. > >First, DIGEST-MD5 need authcid and authzid too, Technically speaking, the DIGEST-MD5 A1 hash doesn't include the authzid. >it isn't possible to >initialize a hashed password database suitable for DIGEST-MD5 using >the password only. I'll s/password/credentials/ in the above. >Secondly, how will this interact with the non-ASCII handling in >CRAM-MD5 and DIGEST-MD5? I think that exactly how PLAIN credentials interact with credentials of other mechanisms should be viewed as an implementation detail as the syntax and semantics of those credentials is mechanism specific. But as Sam said, I think the WG intends to use SASLprep for all username and password appearing in such mechanisms. >Should the PLAIN server SASLprep() the >strings or not, before hashing them and storing them in the database, >for later use with *-MD5? The answer appears to depend on how >*-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and >DIGEST-MD5bis does not currently mention SASLprep. > >Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque >data except SPC?), it would be prudent to mention in the security >considerations that if someone currently uses non-ASCII usernames in >PLAIN, the SASLprep() operation may cause changes to the username. >This warning may be more appropriate in the saslprep document, but >that document doesn't have a security consideration currently. E.g., >if someone has a system with two users "foo" and >"fooss", the SASLprep() operation translates the first string into the >latter before database comparison, whereas the application does not >necessarily perform the same translation. The consequences appears to >be that someone who knows the password for "fooss" may also be >authenticated as "foo". Well, saslprep should have a security consideration section. I think it fine to elaborate that the profile as to why it is not intended to be applied to identities which are not simple user names and related issued. Also, I think 2222bis should be more clear that the form which authentication credentials take and how they are used to authenticate the user is mechanism specific. Applications should be avoid overloading syntax and semantics. I don't see the PLAIN I-D needing any additional text here. Kurt Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUxAF097406 for ; Sat, 17 May 2003 14:30:59 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HLUxXo097405 for ietf-sasl-bks; Sat, 17 May 2003 14:30:59 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HLUwAF097400 for ; Sat, 17 May 2003 14:30:58 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id BF5C3152451; Sat, 17 May 2003 17:26:53 -0400 (EDT) To: Simon Josefsson Cc: ietf-sasl@imc.org Subject: Re: Comments on draft-ietf-sasl-plain-01.txt References: From: Sam Hartman Date: Sat, 17 May 2003 17:26:53 -0400 In-Reply-To: (Simon Josefsson's message of "Sat, 17 May 2003 23:02:18 +0200") Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: >>>>> "Simon" == Simon Josefsson writes: Simon> Secondly, how will this interact with the non-ASCII Simon> handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN Simon> server SASLprep() the strings or not, before hashing them Simon> and storing them in the database, for later use with *-MD5? Simon> The answer appears to depend on how *-MD5bis will handle Simon> non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis Simon> does not currently mention SASLprep. We agreed in San Francisco that digest-md5 would use saslprep. I believe we agreed the same for cram-md5. Those updates are pending. --Sam Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2PAF096888 for ; Sat, 17 May 2003 14:02:25 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HL2PZf096887 for ietf-sasl-bks; Sat, 17 May 2003 14:02:25 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from yxa.extundo.com (178.230.13.217.in-addr.dgcsystems.net [217.13.230.178]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HL2NAF096881 for ; Sat, 17 May 2003 14:02:24 -0700 (PDT) (envelope-from jas@extundo.com) Received: from latte-wlan.josefsson.org (yxa.extundo.com [217.13.230.178]) (authenticated bits=0) by yxa.extundo.com (8.12.9/8.12.9) with ESMTP id h4HL2IB4004454 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=OK) for ; Sat, 17 May 2003 23:02:18 +0200 To: ietf-sasl@imc.org Subject: Comments on draft-ietf-sasl-plain-01.txt From: Simon Josefsson X-Payment: hashcash 1.2 0:030517:ietf-sasl@imc.org:89c03113bd990658 X-Hashcash: 0:030517:ietf-sasl@imc.org:89c03113bd990658 Date: Sat, 17 May 2003 23:02:18 +0200 Message-ID: User-Agent: Gnus/5.1003 (Gnus v5.10.3) Emacs/21.3.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Status: No, hits=-6.3 required=5.0 tests=USER_AGENT_GNUS_UA autolearn=ham version=2.50 X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: The server MAY also use the password to initialize any new authentication database, such as one suitable for [CRAM-MD5] or [DIGEST-MD5]. First, DIGEST-MD5 need authcid and authzid too, it isn't possible to initialize a hashed password database suitable for DIGEST-MD5 using the password only. Secondly, how will this interact with the non-ASCII handling in CRAM-MD5 and DIGEST-MD5? Should the PLAIN server SASLprep() the strings or not, before hashing them and storing them in the database, for later use with *-MD5? The answer appears to depend on how *-MD5bis will handle non-ASCII, but there is no CRAM-MD5bis, and DIGEST-MD5bis does not currently mention SASLprep. Since 2195 is unclear on the username syntax (ASCII? UTF-8? Opaque data except SPC?), it would be prudent to mention in the security considerations that if someone currently uses non-ASCII usernames in PLAIN, the SASLprep() operation may cause changes to the username. This warning may be more appropriate in the saslprep document, but that document doesn't have a security consideration currently. E.g., if someone has a system with two users "foo" and "fooss", the SASLprep() operation translates the first string into the latter before database comparison, whereas the application does not necessarily perform the same translation. The consequences appears to be that someone who knows the password for "fooss" may also be authenticated as "foo". Thanks. Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGRAF092906 for ; Sat, 17 May 2003 12:16:27 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.9/8.12.9/Submit) id h4HJGRUu092905 for ietf-sasl-bks; Sat, 17 May 2003 12:16:27 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from konishi-polis.mit.edu (STRATTON-TWO-SIXTY-TWO.MIT.EDU [18.187.6.7]) by above.proper.com (8.12.9/8.12.8) with ESMTP id h4HJGQAF092900 for ; Sat, 17 May 2003 12:16:26 -0700 (PDT) (envelope-from hartmans@mit.edu) Received: by konishi-polis.mit.edu (Postfix, from userid 8042) id AE804152451; Sat, 17 May 2003 15:12:42 -0400 (EDT) To: ietf-sasl@imc.org Subject: Last Call for draft-ietf-sasl-plain-01 From: Sam Hartman Date: Sat, 17 May 2003 15:12:42 -0400 Message-ID: User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This message initiates a SASL Working Group Last Call on the document: Title : The Plain SASL Mechanism Editor : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt The purpose of this WG Last Call is to ensure that the Working Group has achieved consensus that the document is suitable for publication as a Proposed Standard. Please review the document for both technical and editorial problems. Technical issues should be discussed on this list. Editorial issues may be sent to the document editor. The Last Call period will end on Monday, June 2, 2003. Upon completion of the last call, the WG chair(s) will take action based upon the consensus of the WG. Possible actions include: 1) recommending to the IETF Security Area Directors that the document, after possible editorial or other minor changes, be considered by the IESG for publication as a Standard Track RFC (which generally involves an IETF-wide Last Call); or 2) requiring that outstanding issues be adequately addressed prior to further action (including, possibly, another WG Last Call). Remember that it is our responsibility as Working Group members to ensure the quality of our documents and of the Internet Standards process. So, please read and comment! - Sam Hartman SASL co-chair Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhVi2080249 for ; Tue, 6 May 2003 07:43:31 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EhVxT080248 for ietf-sasl-bks; Tue, 6 May 2003 07:43:31 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46EhUi2080243 for ; Tue, 6 May 2003 07:43:30 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46EhVc6009682 for ; Tue, 6 May 2003 14:43:31 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506074017.02c84be0@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:41:02 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: SASLprep Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-saslprep based upon list and off-list comment. Please review and comment. Thanks, Kurt Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egfi2080227 for ; Tue, 6 May 2003 07:42:41 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46EgfAd080226 for ietf-sasl-bks; Tue, 6 May 2003 07:42:41 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from pretender.boolean.net (root@router.boolean.net [198.144.206.49]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Egei2080221 for ; Tue, 6 May 2003 07:42:40 -0700 (PDT) (envelope-from Kurt@OpenLDAP.org) Received: from nomad.OpenLDAP.org (kurt@localhost [127.0.0.1]) by pretender.boolean.net (8.12.8/8.12.8) with ESMTP id h46Egfc6009677 for ; Tue, 6 May 2003 14:42:41 GMT (envelope-from Kurt@OpenLDAP.org) Message-Id: <5.2.0.9.0.20030506073836.02c7b3e8@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Tue, 06 May 2003 07:40:12 -0700 To: ietf-sasl@imc.org From: "Kurt D. Zeilenga" Subject: PLAIN In-Reply-To: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have updated draft-ietf-sasl-plain based upon list and off-list comments. Please review and comment. Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkGi2066614 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BkGkN066613 for ietf-sasl-bks; Tue, 6 May 2003 04:46:16 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46BkFi2066608 for ; Tue, 6 May 2003 04:46:16 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15357; Tue, 6 May 2003 07:43:18 -0400 (EDT) Message-Id: <200305061143.HAA15357@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-plain-01.txt Date: Tue, 06 May 2003 07:43:18 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Plain SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-plain-01.txt Pages : 8 Date : 2003-5-5 This document defines a simple clear-text user/password Simple Authentication and Security Layer (SASL) mechanism called the PLAIN mechanism. The PLAIN mechanism intended to be used, in combination with data confidentiality services provided by a lower layer, in protocols which lack a simple password authentication command. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-plain-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-plain-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-plain-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-plain-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-plain-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151206.I-D@ietf.org> --OtherAccess-- --NextPart-- Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Biii2066558 for ; Tue, 6 May 2003 04:44:44 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BiiSf066557 for ietf-sasl-bks; Tue, 6 May 2003 04:44:44 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bihi2066551 for ; Tue, 6 May 2003 04:44:43 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15295; Tue, 6 May 2003 07:41:46 -0400 (EDT) Message-Id: <200305061141.HAA15295@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-anon-01.txt Date: Tue, 06 May 2003 07:41:46 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : The Anonymous SASL Mechanism Author(s) : K. Zeilenga Filename : draft-ietf-sasl-anon-01.txt Pages : 8 Date : 2003-5-5 It is common practice on the Internet to permit anonymous access to various services. Traditionally, this has been done with a plain text password mechanism using 'anonymous' as the user name and optional trace information, such as an email address, as the password. As plaintext login commands are not permitted in new IETF protocols, a new way to provide anonymous login is needed within the context of the Simple Authentication and Security Layer (SASL) framework. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-anon-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-anon-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-anon-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-anon-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-anon-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151154.I-D@ietf.org> --OtherAccess-- --NextPart-- Received: from above.proper.com (localhost [127.0.0.1]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bidi2066545 for ; Tue, 6 May 2003 04:44:39 -0700 (PDT) (envelope-from owner-ietf-sasl@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.8p1/8.12.9/Submit) id h46BidJx066544 for ietf-sasl-bks; Tue, 6 May 2003 04:44:39 -0700 (PDT) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-sasl@mail.imc.org using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.12.8p1/8.12.8) with ESMTP id h46Bici2066539 for ; Tue, 6 May 2003 04:44:38 -0700 (PDT) (envelope-from nsyracus@cnri.reston.va.us) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA15279; Tue, 6 May 2003 07:41:41 -0400 (EDT) Message-Id: <200305061141.HAA15279@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-sasl@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-sasl-saslprep-01.txt Date: Tue, 06 May 2003 07:41:41 -0400 Sender: owner-ietf-sasl@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF. Title : SASLprep: Stringprep profile for user names and passwords Author(s) : K. Zeilenga Filename : draft-ietf-sasl-saslprep-01.txt Pages : 5 Date : 2003-5-5 This document describes how to prepare Unicode strings representing user names and passwords for comparison. The document defines the 'SASLprep' 'stringprep' profile to be used for both user names and passwords. This profile is intended to be used by Simple Authentication and Security Layer (SASL) mechanisms (such as PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging user names and/or passwords. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-01.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sasl-saslprep-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sasl-saslprep-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sasl-saslprep-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-5-5151143.I-D@ietf.org> --OtherAccess-- --NextPart--