Re: CRAM-SHA1 support

[Simon Josefsson]

Lothar May <address@hidden> writes:

> Hi Simon,
>
> 2009/9/3 Simon Josefsson <address@hidden>:
> [...]
>>> Same for this:
>>>
>>>      client-first-message-bare =
>>>                        [reserved-mext ","]
>>>                        username "," nonce ["," extensions]
>>>
>>>      reserved-mext  = "m=" 1*(value-char)
>>>                        ;; Reserved for signalling mandatory extensions.
>>>                        ;; The exact syntax will be defined in
>>>                        ;; the future.
>>>
>>> There is an optional argument at the beginning. So the username
>>> "m=..." is not valid? Or do you have to count how many commas there
>>> are? This seems very strange. I have more questions like this, which
>>> tells me that I'm probably not the right one to implement this... :-/
>>
>> The fields are comma-separated, and ',' needs to be escaped inside the
>> value-char's, check the definition of 'value-safe-char'.
>
> What I meant was, if I start parsing "client-first-message-bare", how
> do I know whether the first entry is a username or reserved-mext?

Check if the first character is m or n?  You forgot to quote the
definition of username:

     username        = "n=" saslname

>> If you have time to co-operate on an implementation, and are willing to
>> sign over copyright of your work to the FSF, we could collaborate on
>> doing the SCRAM implementation.  I have some preliminary code for it,
>> but have too little time to work on this right now. :-(
>
> I don't have much time, but might free some, and I'd be willing to
> give it a try. Do I need git to get the latest sources including this
> preliminary code, or is a package available somewhere? I never used
> git before, being quite happy with svn :-).

No code available, it may better to start from scratch since it will
take you the same amount of time to understand my code...  and it was
for an older SCRAM version so it will likely just cause problems.

I'll see if I can create a skeleton to make it more easy to develop and
test it for you though...

/Simon