Re: WG Last Call: draft-ietf-sasl-scram-02

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:

> On Tue, Jul 28, 2009 at 11:23:20PM +0200, Simon Josefsson wrote:
>> Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:
>> > I'll be happy to see this SHOULD turn into a MUST.
>> 
>> The last sentence still seems necessary though.  So the paragraph
>> becomes:
>> 
>>   Clients MUST choose the tls-unique channel binding type.  Servers MUST
>>   choose the channel binding type indicated by the client, if they
>>   support it.
>> 
>> I suspect we want SCRAM and GS2 to be consistent on this, right?  So
>> both documents needs this change.
>
> Yes.
>
> Also, we should allow application protocols to specify a different CB
> type.
>
>    Clients MUST choose the default channel binding type for the
>    application -- 'tls-unique' for any applications that don't specify
>    one.  Servers MUST choose the channel binding type indicated by the
>    client, or fail authentication if they don't support it.

Works for me.  Chris, Alexey, others, are you OK with that text?  I'll
update my copy of GS2 to use it if we all agree on this text.

/Simon