Re: SCRAM methods

[Jeremy Harris]

On 06/01/2020 11:06, Simon Josefsson wrote:
[client side]
> My conclusion is that clients should store SaltedPassword/Salt/Itercnt.
> I'm not sure adding support for CLIENTKEY/SERVERKEY is really worth the
> trouble.  Cyrus SASL only seems to support raw clear-text passwords in
> the client.
> 
> Am I missing something?

Are compute-costs likely to be an issue for the clients likely to
use gsasl?  Option 3 does take out two hmac operations versus option2.
Probably not large compared to the saving of the Hi() gained by 2 over
1.
-- 
Cheers,
  Jeremy