Subject: I-D ACTION:draft-ietf-sasl-crammd5-10.txt

From: [email-masked]
Date: Mon, 14 Jul 2008 11:45:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF.

	Title		: The CRAM-MD5 SASL Mechanism
	Author(s)	: L. Nerenberg
	Filename	: draft-ietf-sasl-crammd5-10.txt
	Pages		: 10
	Date		: 2008-7-11
	
This document defines a simple challenge-response authentication
   mechanism, using a keyed MD5 digest, for use with the Simple
   Authentication and Security Layer (SASL).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sasl-crammd5-10.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Chris Newman <[email-masked]>
Date: Fri, 18 Jul 2008 18:20:31 -0700

I have reviewed this and support its advancement on the standards track.

		- Chris

---

From: Tom Yu <[email-masked]>
Date: Mon, 28 Jul 2008 05:29:36 -0400

> I have reviewed this and support its advancement on the standards track.

We had Working Group consensus to take CRAM-MD5 off the standards
track.  Are you suggesting that we re-evaluate that consensus?

---

From: "Frank Ellermann" <[email-masked]>
Date: Mon, 28 Jul 2008 12:36:21 +0200

Tom Yu wrote:

> Are you suggesting that we re-evaluate that consensus?

Not speaking for Chris, I'd certainly oppose to "demote"
CRAM-MD5.  A fine, mature draft standard.  Of course it
has various limitations, maturity comes with "old", but
"old" is not always "obsolete".  

I've submitted a modification request for the CRAM-MD5 
registry enter, the "intended use" should be "COMMON".

 1F

---

From: Chris Newman <[email-masked]>
Date: Tue, 29 Jul 2008 15:32:56 +0100

I was just performing a technical review of a document with "Intended 
Status: Standards Track" and stating my personal opinion of that intended 
status.  I would not break any consensus that involved publishing a 
revision of CRAM.

		- Chris

---

From: Lyndon Nerenberg <[email-masked]>
Date: Wed, 30 Jul 2008 21:19:20 -0700

> "old" is not always "obsolete".

With my editor's eye-shade firmly removed, I also want to state my  
opposition to taking this document off the standards track. Given that  
almost every modern email client (and most servers) support it, it's  
arguably the most widely deployed SASL mechanism on the Internet  
today. It would be a disservice to each and every one of those end- 
users if we trashed the mechanism, especially considering there is no  
viable replacement anywhere in sight.

While CRAM-MD5 might not live up to the ideals of some IESG members'  
vision of the world, it suffices today – and has for the last fourteen  
years. And in those fourteen years, nothing has come along to supplant  
it. Its success speaks for itself.

When a new mechanism manages to achieve the same degree of deployment  
and acceptance, then we might consign CRAM-MD5 to the bin, but not  
before.

--lyndon