Re: Clarifying the qualities we desire the DIGEST-MD5 replacement to have

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> writes:

> Simon Josefsson writes:
>>Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> writes:
>>> I don't get this.  SASL is not a protocol.  If a textual protocol _uses_
>>> SASL, it must turn SASL blobs into text - e.g. by base64-encoding them.
>> (...)
>> Hex encoding the data as well doesn't cost much, and allows for simpler
>> string handling in some programming languages.
>
> Programs that treat SASL blobs as text are broken and possibly a
> security hazard.  At least unless they check the syntax first.
> (For C, that the blob contains no '\0'.)

Sure, but internally in a mechanism, using text can simplify parsing and
debugging for some programming languages.

(But it can also complicate parsing... see DIGEST-MD5)

I don't feel strongly about it, but it may be a good idea.  There is
precedent given PLAIN, CRAM-MD5 and DIGEST-MD5.

/Simon