Re: Poll: use of TLS channel bindings in SCRAM

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Wed, Jun 03, 2009 at 07:31:45AM +0200, Simon Josefsson wrote:
> Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:
> > There is a slightly better way that would simplify the client: define
> > new GS2 CB flags to go with the 'n', 'y', and 'p' that we have now
> > (which would stay as they have been, w/o any additional GS2 header
> > fields).  The three flags we have now:
> >
> > ...
> >
> > Simplifying the client strikes me as a good thing.
> 
> It adds more text to the specification, and some complexity, but it
> seems like a reasonable compromise to simplify client implementations.

It does add more text to the spec, but server-side complexity is not
really changed, and the client is simplified.  I'm OK with either plan,
though I think I prefer this one.

> Before I update GS2 with that, what is the chance of making these
> changes to SCRAM?  Alexey?

We'll know soon enough.  The poll ends this week.

Nico
--