Re: Optional domain/realm for SCRAM? (Re: Crypto agility in SCRAM + draft-josefsson-password-auth?)

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Tue, Mar 18, 2008 at 06:42:54PM +0100, Hallvard B Furuseth wrote:
> 
> Simon Josefsson writes:
> > I'm not strongly opposed to realms, but if it leads to complexity in the
> > protocol, I think we should motivate it carefully.
> 
> As far as I can tell, a realm is nothing but a salt common for all
> users on the server.  SCRAM supports a salt.  Am I missing something?

It's a bit more than that: it's an extra layer in the key hierarchy.
And that's so that the realm can generate the verifiers for all users
for any new server without having to know the cleartext passwords.

But again, the point is moot.