Subject: rfc2222bis: suggested text about multiple SASL mechanisms

From: Hallvard B Furuseth <[email-masked]>
Date: Sun, 9 Nov 2003 20:31:56 +0100

I suggest this text is added to rfc2222bis, probably in the Security
Considerations.  I stole it from draft-ietf-ldapbis-authmeth-08.txt and
de-LDAPified it.

   If the client fetches a list of supported SASL mechanisms from the
   server and bases its choice of SASL mechanism on the result, it
   SHOULD fetch that list both before and after the SASL security layer
   is negotiated.  This allows the client to detect active attacks that
   remove mechanisms from the server's list of supported mechanisms, and
   allows the client to ensure that it is using the best mechanism
   supported by both client and server.

-- 
Hallvard