Re: SASL WG session at IETF68

[Frank Ellermann <nobody@xxxxxxxxxxxxxxxxx>]

Alexey Melnikov wrote:

>> Finally the second part says implementations won't bother
>> to check the certificate, and then PLAIN isn't good enough.

> This is the part I would like to discuss.
 
>> Now that's tricky, if it's true you could as well replace
>> the "MUST do PLAIN" by a "MUST do CRAM-MD5",
[both over TLS, obviously]

> This wouldn't fly for a set of reasons I wouldn't repeat here.

I don't recall any discussion involving you about "CRAM-MD5 over
TLS" here (or elsewhere).  But I don't read this list very long,
if it was before 2005 I've certainly missed it.

Anyway, if you don't like to replace PLAIN you can either add a
"SHOULD check cert" (the TLS RFC might have some MUSTard in this
direction, I'm too lazy to look), or maybe Sam's argument isn't
correct (?)

Frank