Subject: CAP TODO: MITM

From: Doug Royer <[email-masked]>
Date: Fri, 09 Nov 2001 12:40:58 -0700

> - Danger of MITM attacks with weak authentication?
>  see post: "CAP: SASL mechanisms and MITM attacks"

We mandate that DIGEST be implemented. Is that subject
to MITM attacks - I don't think so.

If a CUA/CS decide on a weak authentication - that is out
of scope for CAP. We might want to in the security section
point out why doing weak authentication is stupid and don't do that.

CAP is not designing security.

We are using already designed security - I don't think
we picked a bad one.

-Doug

---

From: George Babics <[email-masked]>
Date: Tue, 20 Nov 2001 12:33:08 -0500

I'll remove it from the to do list. Let me know if
you have any objections.

BTW, the CAP to-do and issues list can be accessed at: 

  http://calsch.org/ietf/cap-ToDo.html

George