Re: Crypto agility in SCRAM + draft-josefsson-password-auth?

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Tue, Mar 18, 2008 at 04:21:49PM +0000, Tony Finch wrote:
> On Tue, 18 Mar 2008, Nicolas Williams wrote:
> > One day your servers all have SCRAM HMAC-MD5 verifiers for your users'
> > names and passwords.  The next you want to move to SCRAM HMAC-SHA-224,
> > but you don't have any of those verifiers.  How do you complete the
> > migration, operationally?
> 
> The usual way to avoid too much interaction with users is to instrument
> the authentication process to capture passwords verified by the old
> mechanism and re-encode them using the new mechanism.

Right, that's one of the ways I considered.  Both of the answers I
suggested require additional bits on the wire in SCRAM.

> > > [...]
> > Putting the hash negotiation inside SCRAM doesn't help you with that.
> 
> It depends on whether clients are good at automatic fail-over from one
> SASL mechanism to another. If you negotiate the algorithm after you know
> who the user is, the server can advertise different algorithms for
> different users, and advertise only the algorithms that have a chance of
> working, so client-side fail-over isn't required.

Ah, good point.  Without a hash negotiation inside SCRAM you have to
effectively deploy verifiers for all your users before you start
advertising the SCRAM with new hash functions.

Nico
--