Subject: I-D Action:draft-ietf-sasl-digest-to-historic-00.txt

From: [email-masked]
Date: Tue, 29 Jul 2008 09:15:03 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF.

	Title           : Moving DIGEST-MD5 to Historic
	Author(s)       : A. Melnikov
	Filename        : draft-ietf-sasl-digest-to-historic-00.txt
	Pages           : 7
	Date            : 2008-07-29

This memo describes problems with the DIGEST-MD5 Simple
Authentication and Security Layer (SASL) mechanism as specified in
RFC 2831.  It recommends that DIGEST-MD5 to be marked as OBSOLETE in
the IANA Registry of SASL mechanisms, and that RFC 2831 be moved to
Historic status.

Note

A revised version of this draft document will be submitted to the RFC
editor as a Proposed Standard for the Internet Community.  Discussion
and suggestions for improvement are requested, and should be sent to
[email-masked].

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sasl-digest-to-historic-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 30 Jul 2008 13:54:02 +0200

> Filename        : draft-ietf-sasl-digest-to-historic-00.txt

In the otherwise apparently complete list of problems add:

| 9.  MD5-sess in RFC 2831 and RFC 2617 are incompatible.
|     RFC 2831 uses a "raw" (binary) hash, where RFC 2617
|     uses a hex. representation of this hash.
|     A corresponding RFC 2617 erratum was reported after
|     the publication of RFC 2831.

Of course all MD5-sess RFC 2831 examples published in RFCs
use the RFC 2831 variant, not the RFC 2617 variant.  

The second statement about the RFC 2617 erratum might be
unnecessary, but it explains how that happened, and that
this was not some intentional RFC 2831 feature.

 Frank