Re: Security

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Kurt Zeilenga <Kurt.Zeilenga@xxxxxxxxx> writes:

>>>> None of the arguments made in the
>>>> document would still stand against that construct (I think).  What
>>>> is
>>>> puzzling is that the document already appear to strongly suggest use
>>>> of
>>>> TLS and UTF-8 and SASLprep, so I think we have already solved the
>>>> security and interoperability problem inherent in the old CRAM-MD5
>>>> specification.
>>>
>>> I don't believe the SHOULDs are adequate to ensure independently
>>> developed interoperability.
>>
>> SHOULD has worked fine for PLAIN, so I disagree.
>
> It works fine because of PLAIN's design.  The party, the server, is
> preparing both the presented and stored strings.   In CRAM-MD5, two
> parties need to agree on the preparation on what preparation to use
> for things to work properly.

Ah, I understand your objection now.

Given that RFC 2195 appears to be ASCII only, I don't see a problem with
extending it to UTF-8 in a revised version and mandate that using a
SHOULD or MUST though.  If some client/server uses some other mechanism
to send non-ASCII, they weren't following the RFC anyway.

/Simon