Skip to content

Commit

Permalink
Add more drafts
Browse files Browse the repository at this point in the history 
Updated the documentation to include the latest revisions of
draft-melnikov-scram-bis and draft-melnikov-scram-sha3-512 in the
set of LDAP-related specifications.
  • Loading branch information
@dirmgr
dirmgr committed Aug 24, 2023
1 parent e89a6ed commit 1b0604b
Show file tree
Hide file tree
Showing 4 changed files with 70 additions and 69 deletions.
5 changes: 3 additions & 2 deletions docs/release-notes.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,8 +88,9 @@ <h3>Version 6.0.10</h3>
</li>

<li>
Updated the documentation to include the latest version of
draft-ietf-kitten-scram-2fa in the set of LDAP-related specifications.
Updated the documentation to include the latest versions of
draft-ietf-kitten-scram-2fa, draft-melnikov-scram-bis, and
draft-melnikov-scram-sha3-512 in the set of LDAP-related specifications.
<br><br>
</li>
</ul>
Expand Down
54 changes: 27 additions & 27 deletions docs/specs/draft-melnikov-scram-bis-02.txt → docs/specs/draft-melnikov-scram-bis-03.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,14 @@

Network Working Group A. Melnikov, Ed.
Internet-Draft Isode Ltd
Updates: 5802, 7677 (if approved) 13 January 2023
Updates: 5802, 7677 (if approved) 24 August 2023
Intended status: Standards Track
Expires: 17 July 2023
Expires: 25 February 2024


Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-
API Mechanisms
draft-melnikov-scram-bis-02
draft-melnikov-scram-bis-03

Abstract

Expand All @@ -35,7 +35,7 @@ Status of This Memo
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."

This Internet-Draft will expire on 17 July 2023.
This Internet-Draft will expire on 25 February 2024.

Copyright Notice

Expand All @@ -53,9 +53,9 @@ Copyright Notice



Melnikov Expires 17 July 2023 [Page 1]
Melnikov Expires 25 February 2024 [Page 1]

Internet-Draft SASL SCRAM January 2023
Internet-Draft SASL SCRAM August 2023


Table of Contents
Expand Down Expand Up @@ -109,9 +109,9 @@ Table of Contents



Melnikov Expires 17 July 2023 [Page 2]
Melnikov Expires 25 February 2024 [Page 2]

Internet-Draft SASL SCRAM January 2023
Internet-Draft SASL SCRAM August 2023


3. Implementation Recommendations
Expand All @@ -132,7 +132,8 @@ Internet-Draft SASL SCRAM January 2023
SHA3-512 [I-D.melnikov-scram-sha3-512] instead of SCRAM-SHA-1-PLUS/
SCRAM-SHA-1 [RFC5802].

[RFC5803] describes how SCRAM hashes can be stored in LDAP. It is
[RFC5803] describes how SCRAM hashes can be stored in LDAP. The LDAP
format has a field for the hash algorithm name used, so it is
compatible with all versions of SCRAM described in this document,
including SCRAM-SHA-256, SCRAM-SHA-512 and SCRAM-SHA3-512.

Expand Down Expand Up @@ -161,15 +162,15 @@ Internet-Draft SASL SCRAM January 2023
gives around 15,000 iterations required; however, a hash iteration-
count of 10000 takes around 0.5 seconds on current mobile handsets.
This computational cost can be avoided by caching the ClientKey
(assuming the Salt and hash iteration-count is stable). Therefore,



Melnikov Expires 17 July 2023 [Page 3]
Melnikov Expires 25 February 2024 [Page 3]

Internet-Draft SASL SCRAM January 2023
Internet-Draft SASL SCRAM August 2023


(assuming the Salt and hash iteration-count is stable). Therefore,
the recommendation of this specification is that the hash iteration-
count SHOULD be at least 10000, but careful consideration ought to be
given to using a significantly higher value, particularly where
Expand Down Expand Up @@ -213,17 +214,16 @@ Internet-Draft SASL SCRAM January 2023
DOI 10.17487/RFC5803, July 2010,
<https://www.rfc-editor.org/info/rfc5803>.

[RFC6234] Eastlake 3rd, D., Hansen, T., and RFC Publisher, "US
Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)",
RFC 6234, DOI 10.17487/RFC6234, May 2011,
[RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms
(SHA and SHA-based HMAC and HKDF)", RFC 6234,
DOI 10.17487/RFC6234, May 2011,
<https://www.rfc-editor.org/info/rfc6234>.




Melnikov Expires 17 July 2023 [Page 4]
Melnikov Expires 25 February 2024 [Page 4]

Internet-Draft SASL SCRAM January 2023
Internet-Draft SASL SCRAM August 2023


[RFC7627] Bhargavan, K., Ed., Delignat-Lavaud, A., Pironti, A.,
Expand Down Expand Up @@ -252,34 +252,34 @@ Internet-Draft SASL SCRAM January 2023
[I-D.kitten-scram-2fa]
Melnikov, A., "Extensions to Salted Challenge Response
(SCRAM) for 2 factor authentication", Work in Progress,
Internet-Draft, draft-ietf-kitten-scram-2fa-02, 13 January
Internet-Draft, draft-ietf-kitten-scram-2fa-03, 24 August
2023, <https://www.ietf.org/archive/id/draft-ietf-kitten-
scram-2fa-02.txt>.
scram-2fa-03.txt>.

[I-D.melnikov-scram-sha-512]
Melnikov, A., "SCRAM-SHA-512 and SCRAM-SHA-512-PLUS Simple
Authentication and Security Layer (SASL) Mechanisms", Work
in Progress, Internet-Draft, draft-melnikov-scram-sha-
512-02, 19 October 2021, <https://www.ietf.org/internet-
drafts/draft-melnikov-scram-sha-512-02.txt>.
512-03, 10 March 2022, <https://www.ietf.org/internet-
drafts/draft-melnikov-scram-sha-512-03.txt>.

[I-D.melnikov-scram-sha3-512]
Melnikov, A., "SCRAM-SHA3-512 and SCRAM-SHA3-512-PLUS
Simple Authentication and Security Layer (SASL)
Mechanisms", Work in Progress, Internet-Draft, draft-
melnikov-scram-sha3-512-02, 19 October 2021,
melnikov-scram-sha3-512-03, 24 August 2023,
<https://www.ietf.org/internet-drafts/draft-melnikov-
scram-sha3-512-02.txt>.
scram-sha3-512-03.txt>.

6.2. Informative References





Melnikov Expires 17 July 2023 [Page 5]
Melnikov Expires 25 February 2024 [Page 5]

Internet-Draft SASL SCRAM January 2023
Internet-Draft SASL SCRAM August 2023


[RFC4270] Hoffman, P. and B. Schneier, "Attacks on Cryptographic
Expand Down Expand Up @@ -333,4 +333,4 @@ Author's Address



Melnikov Expires 17 July 2023 [Page 6]
Melnikov Expires 25 February 2024 [Page 6]
72 changes: 36 additions & 36 deletions ...pecs/draft-melnikov-scram-sha3-512-02.txt → ...pecs/draft-melnikov-scram-sha3-512-03.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@

Network Working Group A. Melnikov, Ed.
Internet-Draft Isode Ltd
Intended status: Standards Track 19 October 2021
Expires: 22 April 2022
Intended status: Standards Track 24 August 2023
Expires: 25 February 2024


SCRAM-SHA3-512 and SCRAM-SHA3-512-PLUS Simple Authentication and
Security Layer (SASL) Mechanisms
draft-melnikov-scram-sha3-512-02
draft-melnikov-scram-sha3-512-03

Abstract

Expand All @@ -32,30 +32,30 @@ Status of This Memo
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."

This Internet-Draft will expire on 22 April 2022.
This Internet-Draft will expire on 25 February 2024.

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.






Melnikov Expires 22 April 2022 [Page 1]
Melnikov Expires 25 February 2024 [Page 1]

Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS August 2023


Table of Contents
Expand Down Expand Up @@ -109,9 +109,9 @@ Table of Contents



Melnikov Expires 22 April 2022 [Page 2]
Melnikov Expires 25 February 2024 [Page 2]

Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS August 2023


4. Security Considerations
Expand All @@ -125,12 +125,12 @@ Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
default channel binding to use (see Section 6.1 of [RFC5802]),
assuming the above conditions are satisfied. As "tls-unique" channel
binding is not defined for TLS 1.3 [RFC8446], when using SCRAM over
TLS 1.3, the "tls-exporter" channel binding [tls-1.3-channel-binding]
MUST be the default channel binding (in the sense specified in
Section 6.1 of [RFC5802]) to use.
TLS 1.3, the "tls-exporter" channel binding [RFC9266] MUST be the
default channel binding (in the sense specified in Section 6.1 of
[RFC5802]) to use.

See [RFC4270] and [RFC6194] for reasons to move from SHA-1 to a
strong security mechanism like SHA3-512.
stronger security mechanism like SHA3-512.

The strength of this mechanism is dependent in part on the hash
iteration-count, as denoted by "i" in [RFC5802]. As a rule of thumb,
Expand Down Expand Up @@ -165,9 +165,9 @@ Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021



Melnikov Expires 22 April 2022 [Page 3]
Melnikov Expires 25 February 2024 [Page 3]

Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS August 2023


Minimum iteration-count: 10000
Expand Down Expand Up @@ -221,9 +221,9 @@ Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021



Melnikov Expires 22 April 2022 [Page 4]
Melnikov Expires 25 February 2024 [Page 4]

Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS August 2023


[RFC4422] Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
Expand Down Expand Up @@ -256,12 +256,9 @@ Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>.

[tls-1.3-channel-binding]
Whited, S., "Channel Bindings for TLS 1.3", Work in
Progress, Internet-Draft, draft-ietf-kitten-tls-channel-
bindings-for-tls13-11, 18 October 2021,
<https://www.ietf.org/archive/id/draft-ietf-kitten-tls-
channel-bindings-for-tls13-11.txt>.
[RFC9266] Whited, S., "Channel Bindings for TLS 1.3", RFC 9266,
DOI 10.17487/RFC9266, July 2022,
<https://www.rfc-editor.org/info/rfc9266>.

[NIST.FIPS.202]
Dworkin, M., "SHA-3 Standard: Permutation-Based Hash and
Expand All @@ -272,21 +269,19 @@ Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021

6.2. Informative References

[RFC4270] Hoffman, P. and B. Schneier, "Attacks on Cryptographic
Hashes in Internet Protocols", RFC 4270,
DOI 10.17487/RFC4270, November 2005,
<https://www.rfc-editor.org/info/rfc4270>.





Melnikov Expires 22 April 2022 [Page 5]
Melnikov Expires 25 February 2024 [Page 5]

Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS October 2021
Internet-Draft SASL SCRAM-SHA3-512/SCRAM-SHA3-512-PLUS August 2023


[RFC4270] Hoffman, P. and B. Schneier, "Attacks on Cryptographic
Hashes in Internet Protocols", RFC 4270,
DOI 10.17487/RFC4270, November 2005,
<https://www.rfc-editor.org/info/rfc4270>.

[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", RFC 5226,
DOI 10.17487/RFC5226, May 2008,
Expand All @@ -311,7 +306,6 @@ Author's Address
Hampton
TW12 2NP
United Kingdom

Email: [email protected]


Expand All @@ -333,4 +327,10 @@ Author's Address



Melnikov Expires 22 April 2022 [Page 6]






Melnikov Expires 25 February 2024 [Page 6]
8 changes: 4 additions & 4 deletions docs/specs/internet-drafts.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -623,9 +623,9 @@ <h2>LDAP Specifications Defined in Internet Drafts</h2>
</li>

<li>
<a href="draft-melnikov-scram-bis-02.txt">draft-melnikov-scram-bis-02</a>: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms
<a href="draft-melnikov-scram-bis-03.txt">draft-melnikov-scram-bis-03</a>: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms
<br>
Expiration Date: July 17, 2023
Expiration Date: February 25, 2024
<br><br>
</li>

Expand All @@ -637,9 +637,9 @@ <h2>LDAP Specifications Defined in Internet Drafts</h2>
</li>

<li>
<a href="draft-melnikov-scram-sha3-512-02.txt">draft-melnikov-scram-sha3-512-02</a>: SCRAM-SHA3-512 and SCRAM-SHA3-512-PLUS Simple Authentication and Security Layer (SASL) Mechanisms
<a href="draft-melnikov-scram-sha3-512-03.txt">draft-melnikov-scram-sha3-512-03</a>: SCRAM-SHA3-512 and SCRAM-SHA3-512-PLUS Simple Authentication and Security Layer (SASL) Mechanisms
<br>
Expiration Date: April 22, 2022
Expiration Date: February 25, 2024
<br><br>
</li>

Expand Down

0 comments on commit 1b0604b

Please sign in to comment.