Subject: [saag] Feedback on Salted EAP draft

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 27 Mar 2015 13:17:15 -0400

Hello,

Dan Harkin's asked that I AD sponsor the following draft:
https://www.iab.org/activities/workshops/caris/

I'm considering it, reviews and opinions are welcome.

Thank you.

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 27 Mar 2015 13:25:12 -0400

I meant to send the link to Dan's draft:
https://tools.ietf.org/html/draft-harkins-salted-eap-pwd-01

Long week...

-- 

Best regards,
Kathleen

---

From: Sam Hartman <[email-masked]>
Date: Fri, 27 Mar 2015 13:34:12 -0400

>>>>> "Kathleen" == Kathleen Moriarty <[email-masked]> writes:

    Kathleen>    I meant to send the link to Dan's draft:
    Kathleen> https://tools.ietf.org/html/draft-harkins-salted-eap-pwd-01
    Kathleen> Long week...

I have briefly reviewed the goals behind this proposal and a sketch of
the details but have not done a technical review of the proposal.

The underlying goal is important and valuable.
This issue is the same issue that was behind my response to your AD
review of the oauth dynamic registration draft.
The more we can do to make it possible to use  deployed password
databases with more modern security, the more we will be able to employ
that modern security.

However, take careful note of section 5 of the draft.

Assuming that  you can get positive technical reviews of the proposal,
this draft seems to solve an important problem that would be valuable to
solve in the EAP community.