Re: Compromise Authentication Proposal

[Phil Pinkerton <phil%jade@wg.icl.co.uk>]

I am quite comfortable with DIGEST-MD5 as the MTI SASL mechanism 'though the
'LDAP Authentication Methods' draft does need to be updated to clarify the
client-server interactions required.  DIGEST provides a relatively simple to
implement protected password mechanism at both client and server end, it
allows third-party authentication mechanisms to be used for those
implementations that need them (getting around the passwords stored at
discreet LDAP servers problem), it provides commonality between different
application types, and it doesn't have the performance overhead of
encrypting all the data.  I don't think TLS with cleartext passwords or
certs solve's any of these problems.  TLS with DIGEST is fine for those
implementations that need it but we don't need to mandate this.

So, Chris, are you going to make your proof-of-concept source code public?
I know that the DIGEST drafts contain example code but you've probably
ironed out all the bugs.

Regards, Phil