Subject: RE: DIGEST-MD5 interop issue

From: "Paul Leach" <[email-masked]>
Date: Fri, 13 Aug 2004 09:57:32 -0700

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Kurt D. Zeilenga
> Sent: Friday, August 13, 2004 12:32 AM
> To: Alexey Melnikov
> Cc: SASL WG
> Subject: Re: DIGEST-MD5 interop issue
> 
> Exactly, the client is making assumptions which prevent users from
being
> able to use it with independently developed servers.  A client which
> cannot
> handle the full range of identity and realm values is simply broken.
For
> instance, my DIGEST-MD5 authentication identity is [email-masked]
in
> the realm [email-masked].  I would not be able to use this or
like
> clients.

[Paul Leach] Use of names and realms of this form was not the intention
when the protocol was spec'd. The idea was that realms would be DNS
names.

You can legitimately gripe that the spec does not make this intention
clear. Or that the client in question doesn't make clear its rules for
transforming what the user types into what gets sent on the wire. Or
both.

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 13 Aug 2004 18:36:10 +0100

Paul Leach wrote:

>>Exactly, the client is making assumptions which prevent users from being
>>    
>>
>>handle the full range of identity and realm values is simply broken. For
>>    
>>
>>instance, my DIGEST-MD5 authentication identity is [email-masked] in
>>    
>>
>>the realm [email-masked].  I would not be able to use this or like
>>    
>>
>>clients.
>>    
>>
>
Although the former might be true, the latter is not, as RFC 2831 has 
the following example of a realm:
[email-masked].

>clear.
Indeed. Text about realms has caused problems before, because it is so 
vague.

> Or that the client in question doesn't make clear its rules for
Yes (both).

Alexey

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 13 Aug 2004 18:36:10 +0100

Yes (both).

Alexey