Re: authmeth: removal of DIGEST-MD5

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Roger Harrison writes:
> Based on the comments to the WG over the past several days, I believe
> that authmeth should only reference DIGEST-MD5 in historical terms.

You should probably keep much of the DIGEST-MD5 text on authmeth-15
page 16 and generalize it to talk about SASL.

> The Simple Mechanism Security Considerations currently state:
>
> The name/password authentication mechanism of the simple Bind method
> discloses the password to the server, which is an inherent security
> risk. There are other mechanisms such as DIGEST-MD5 that do not disclose
> the password to the server.
>
> I would like to replace this reference with DIGEST-MD5 with another
> mechanism (it does not need to be normative) that would not disclose
> the password to the server.  Suggestions?

CRAM-MD5 seems to be the only alternative mechanism which is widely
enough deployed to suggest now.  That mechanism apparently has its own
problems, though.  So I suggest to keep the DIGEST-MD5 reference.

-- 
Hallvard