Subject: RE: Comments about draft-ietf-ldapbis-authmeth-05.txt

From: "Ramsay, Ron" <[email-masked]>
Date: Thu, 14 Aug 2003 11:09:55 +1000

But, but, but ....

They are being used in an LDAP context!

If Digest-MD5 has to be 'localised' to LDAP, it should be done. If it can't be done, let's choose something like CRAM-MD5 for the mandatory-to-implement authentication method.

Ron

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Thursday, 14 August 2003 00:23
To: Alexey Melnikov
Cc: Ramsay, Ron; LDAPBis WG
Subject: Re: Comments about draft-ietf-ldapbis-authmeth-05.txt

At 06:14 AM 8/13/2003, Alexey Melnikov wrote:
>I suggest that some text about the issue should be included in draft-ietf-ldapbis-authmeth.

If authmeth says anything about DNs and DIGEST-MD5, it should say
that the DIGEST-MD5 username and realm fields are, per the DIGEST-MD5
TS, syntactically and semantically not DNs.  They are syntactically
and semantically simple usernames and realms, respectively.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 16 Aug 2003 16:04:04 +0100

>They are being used in an LDAP context!
I agree.

>If Digest-MD5 has to be 'localised' to LDAP, it should be done. If it can't be done, let's choose something like CRAM-MD5 for the mandatory-to-implement authentication method.
CRAM-MD5 will not be better than DIGEST-MD5 in this respect, and 
considering lack of security of the former this is a non-starter.

I don't believe that DIGEST-MD5 says anything that would prevent using 
DNs with it.

>and semantically simple usernames and realms, respectively.
Alexey