[standards-jig] Re: [Foundation] Last Minute JEP 78 Concerns

Dave Smith dizzyd at jabber.org
Tue May 27 19:18:25 UTC 2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Tuesday, May 27, 2003, at 12:47 America/Denver, Iain Shigeoka wrote:

> On Tuesday, May 27, 2003, at 10:38 US/Pacific, Tijl Houtbeckers wrote:
>
> My understanding is that the enhancement is a slight tweak on the 
> existing digest algorithm to protect the user's password _outside_ the 
> context of jabber. However, the arguments for SASL digest seems pretty 
> sound. I haven't really looked at it yet but if it is implementable 
> within restricted environments

Bing, bing! Iain gets it! :)

At any rate, while SASL would be a good way to go, the idea is that our 
digest based scheme will always be available as a super simple fallback 
authentication method, should a server choose to deploy it.  This tweak 
to the digest mechanism was done to ensure, as Iain said, some amount 
of security  outside the context of Jabber.

On Tuesday, May 27, 2003, at 12:01 America/Denver, Matt Tucker wrote:

> The proof is that the client could use the current system and just 
> send sha1(password) instead of password to implement the same thing as 
> edigest. In general, users shouldn't be using the same password for 
> everything. In reality, they sometimes do. So, if you're worried about 
> this and don't want to do encryption in the db, just implement the 
> plain text password hiding client-side. The other benefit is that it 
> doesn't break backwards compatability.

Actually, Matt, this does break backwards compatibility. Let's say I 
use a new client to login/register and it SHA-hashes my password before 
registration, like you suggest. Then I switch to another, older client 
and attempt to login -- that older client will be able to log me in, 
because it simply won't know to SHA-hash the plaintext password before 
SHA-hashing w/ the Stream ID. So we do need a new element for this to 
work.

I'd recommend that we go ahead an use <edigest> and deprecate usage of 
<digest>. This path ensure backwards compatibility.

Diz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (Darwin)

iD8DBQE+07oCYNE3chVHHsMRAtJyAKC8Z4X9i2j8xTBVuHs8HuiCsyV/eACgnGL+
b9TV6tFW2UBI5AXsCuxuQlc=
=pzec
-----END PGP SIGNATURE-----




More information about the Standards mailing list