Subject: supportedSASLMechanisms extra check

From: Leif Johansson <[email-masked]>
Date: Thu, 9 Aug 2001 10:55:48 +0200

During the meeting I raised an issue regarding the use of supportedSASLMechanisms.
As far as I understand the client should, upon establishing a SASL layer go back
to check that a "stronger" layer was not available which might indicate that a
man in the middle had deleted items from the list of supported mechanisms. However
if the client has already negotiated a layer which protects against man in the middle
attacks it is not clear that this extra check is needed. I would suggest that the
wording be changed to reflect this somehow.

	Cheers Leif