Re: Compound authentication "issue"

[Lawrence Greenfield <leg+@xxxxxxxxxxxxxx>]

--On Friday, December 20, 2002 7:37 AM -0600 Dale Gustafson 
<degustafson@xxxxxxxxx> wrote:

> SACRED clients will include a unique value received from the TLS server
> (e.g., during session negotiation) within their digest-MD5 response.

DIGEST-MD5 is a mature standard that's already been deployed in other 
protocols (as a MUST implement for LDAP, for instance).

Changing DIGEST-MD5 is definitely a no-go. If you were going to do that, 
you could just define a new SASL mechanism.

Again, due to the properties of DIGEST-MD5 the attack under consideration 
is thwarted (and I like the proposed text).

Larry