Subject: Changes to the DIGEST-MD5 document

From: Alexey Melnikov <[email-masked]>
Date: Tue, 09 Nov 2004 17:01:11 +0000

I don't think if I've sent a message on this. Below I summarize the 
changes between -03 and -04:

1). Clarified text about realms:
 a). server is not required to advertise all realms it supports.
 b). added more examples
 c). added a new section with requirements on UIs as per discussion with 
Paul Leach.
2). Changed informative "should abort the authentication exchange" to 
"MUST/SHOULD about the authentication exchange" depending on context:
 a). no qop option is recognized by the client - MUST
 b). multiple "stale" directives - MUST
 c). failed SASLPrep on a username - SHOULD
 d). missing or multiple "algorithm" directives - SHOULD (is MUST better 
here?)
 e). multiple "charset" directives - MUST
3). Clarified that if the client recognizes no ciphers, it should behave 
as if "auth-conf" qop was not advertised by the server.
4). Changed "a buffer of security encoded data" to "a buffer of 
protected data", as per terminology change in rfc2222bis.
5). Cleaned up "Changes since ..." section.

I am still waiting for some input from Sam about how to resolve the 
CBC-mode attack fix.

Alexey