Re: Compound authentication "issue"

[Lawrence Greenfield <leg+@xxxxxxxxxxxxxx>]

Upon further consideration, isn't the man-in-the-middle attack
thwarted by the inclusion of "digest-uri-value" in the hash?

The DIGEST-MD5 client hash includes a client-selected
"digest-uri-value" which in sacred's case will be "sacred/<host>". In
a MITM attack, those values will be something else.

A MITM attack as described in the WG meeting is thwarted because
digest-uri-value wouldn't match what the sacred server is expecting.

If it would make people feel better, we can mention this safeguard in
the security considerations section.

Larry