--On March 11, 2008 14:08:06 +0100 Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> wrote:
I don't get this. SASL is not a protocol. If a textual protocol _uses_ SASL, it must turn SASL blobs into text - e.g. by base64-encoding them. If the SASL mechanism also base64-encodes, we get base64(base64(data)).
SASL is an abstraction model that combines two protocols: an authentication mechanism protocol and an application protocol with SASL profile.
The experience I've had with binary authentication mechanism protocols is less than stellar. My product included a non-standard "proxyauth <username>" command that could be issued after authentication for administrative impersonation of a specific user. We also have support for SASL PLAIN with authorization identity which is the standard way to provide the same functionality. But trying to convince people to use the standard protocol rather than the non-standard one has been extremely difficult due to the binary nature of SASL PLAIN. The problem is people don't like to use SASL PLAIN because the NUL octets make it difficult to generate and debug the authentication protocol and custom tools are required to do so. And PLAIN is a really simple case.
Binary creates a barrier to deployment and comprehension of the authentication protocol in my experience.
Another feature: Don't disclose the existence/absense of a user unless authentication succeeds. Or at least don't require it to be disclosed. See my messages "Hide presence/absence of users in server (HEXA, SCRAM)" of 30 Apr 2007.
IMHO, this is a tradeoff between security and usability that has to be configurable. I agree all products should have a way to obscure the distinction between user-doesn't-exist and authentication failed, but for many deployments the usability benefit of exposing users under some circumstances greatly exceeds the security benefit of hiding this information.
Regarding the SCRAM draft, I hope there'll be a version soon which spells out what each challenge and response consists of, and what the server must remember (or be able to construct). It's cumbersome to dig around in the parameter descriptions in order to figure that out.
Agree this needs work. I simply don't have time to be the active editor on the document.
- Chris