horazont / aiosasl / 25
97%

DEFAULT BRANCH: devel
Ran
Jobs 1
Files 5
Run time 71min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
25

push

travis-ci

horazont 
Drop unspecified SCRAM(-PLUS) variants

The following SCRAM variants were previously supported by aiosasl,
but not specified in any IETF document:

* SCRAM-SHA-224(-PLUS)
* SCRAM-SHA-384(-PLUS)
* SCRAM-SHA-512(-PLUS)

The only SCRAM-SHA-* specifications are:

* RFC 7677 <https://tools.ietf.org/html/rfc7677> (SCRAM-SHA-256) and
* RFC 5802 <https://tools.ietf.org/html/rfc5802> (SCRAM-SHA-1).

Of those, RFC 7677 (which defines the registry) explicitly states:

> Note: Members of this family MUST be explicitly registered using
> the "IETF Review" [RFC5226] registration procedure.  Reviews MUST
> be requested on the KITTEN mailing list kitten@ietf.org (or a
> successor designated by the responsible Security Area Director).
>
> […]
>
> Note to future SASL SCRAM mechanism designers: each new SASL
> SCRAM mechanism MUST be explicitly registered with IANA and MUST
> comply with the SCRAM-mechanism naming convention defined in
> Section 4 of [RFC5802].

So while the unspecified mechanisms outlined above adhere to the
naming convention, they’re  not registered with the IANA (see
<https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml>)
at this point in time.

This is thus a violation of the specification/unauthorized
extension of the registered set of algorithms for no good reason.
We should drop them to stay within the specification.

In addition, an argument can be made that it’s not our place to
invent new SCRAM variants without review.

Fixes #6.

343 of 373 relevant lines covered (91.96%)

0.92 hits per line

Jobs
ID Job ID Ran Files Coverage
3 25.3 0
91.96
 Travis Job 25.3
Source Files on build 25
Detailed source file information is not available for this build.