Subject: Re: [kitten] Kitten and Krb-wg Merger

From: Simon Josefsson <[email-masked]>
Date: Tue, 06 Nov 2012 15:31:20 +0100

Shawn M Emery <[email-masked]> writes:

> In light of the pending merger between the kitten and Kerberos WGs we
> have compiled a list of possible work items to start the
> merger/recharter discussions during the combined session on Tuesday.
> We are looking for feedback on this and other items that should be
> considered for the new charter.

I'd like to see support for one-time password / two-factor
authentication needs for SASL applications.

It could be achieved through an explicit new GSS-API/SASL mechanism
(e.g., [1]) or if the consensus is that due to usability reasons, it is
preferrable to do OTP/2FA through an higher level protocol
(Kerberos/OpenID/SAML/SAML20EC/EAP?) prepare a document explaining the
usability problem and provide pointers for implementers.

/Simon

[1] http://tools.ietf.org/html/draft-josefsson-kitten-crotp-00

---

From: William Mills <[email-masked]>
Date: Tue, 6 Nov 2012 07:24:08 -0800 (PST)

Why wouldn't that just be a PLAIN variant?  PLAIN-RSA being defined as SASL PLAIN where the password is the pin and RSA token value concatenated.

>________________________________
> From: Simon Josefsson <[email-masked]>
>To: Shawn M Emery <[email-masked]> 
>Cc: [email-masked] 
>Sent: Tuesday, November 6, 2012 6:31 AM
>Subject: Re: [kitten] Kitten and Krb-wg Merger
> 
>_______________________________________________
>Kitten mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/kitten
>
>
>

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 06 Nov 2012 16:27:05 +0100

Right, that's one option, and I'd be interested in exploring it.  CROTP
is an improvement since it doesn't send clear-text passwords in the
clear, but a PLAIN-OTP or similar could be easier to use in some places.

/Simon

William Mills <[email-masked]> writes:

> Why wouldn't that just be a PLAIN variant?  PLAIN-RSA being defined as
> SASL PLAIN where the password is the pin and RSA token value
> concatenated.
>
>
>
>
>