Re: Clarifying the qualities we desire the DIGEST-MD5 replacement to have

[Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx>]

Simon Josefsson writes:
>Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> writes:
>> I don't get this.  SASL is not a protocol.  If a textual protocol _uses_
>> SASL, it must turn SASL blobs into text - e.g. by base64-encoding them.
> (...)
> Hex encoding the data as well doesn't cost much, and allows for simpler
> string handling in some programming languages.

Programs that treat SASL blobs as text are broken and possibly a
security hazard.  At least unless they check the syntax first.
(For C, that the blob contains no '\0'.)

-- 
Hallvard