Re: Security

[Sam Hartman <hartmans-ietf@xxxxxxx>]

>>>>> "Simon" == Simon Josefsson <simon@xxxxxxxxxxxxx> writes:

    Simon> A more interesting discussion seems to be: Assuming the
    Simon> document recommends CRAM-MD5+TLS sufficiently well (similar
    Simon> to the wording in the PLAIN document), would such a
    Simon> document be acceptable to put on the Standards Track and
    Simon> with the applicability of COMMON?

    Simon> If that is not the WG consensus, it would be clearer to
    Simon> abandon the current CRAM-MD5 specification and produce a
    Simon> "Moving CRAM-MD5 to Historic" document.

I don't see this point at all.
I actually think publishing the current cram-md5 as informational with limited recommended deployment would be a good step forward.
I certainly prefer abandoning cram-md5 to publishing on the standards track.

    Simon> However, I believe CRAM-MD5+TLS, with warnings about
    Simon> channel binding vulnerabilities, is valuable to have on the
    Simon> standards track until there is other solutions that we can
    Simon> recommend instead (i.e., GS2+SCRAM).

I disagree as I've stated previously.