Subject: CRAM-MD5: syntax for challenge

From: Lyndon Nerenberg <[email-masked]>
Date: Sun, 02 Dec 2001 20:15:33 -0700

RFC2195 defines the challenge as having the syntax of a message-id,
and gives some guidance for building the contents. I don't think
the currently recommended scheme is as robust as it could be. Mobile
clients configured via DHCP tend to re-use hostnames and IP addresses;
this diminshes the uniqueness of the host part of the message-id. I'm
leaning towards taking out the recommendation, and instead say the
contents of the challenge must be a random sequence of printable
characters. I would also like to impose a minimum length on the
challenge.

--lyndon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Dec 2001 20:03:10 -0800

At 07:15 PM 2001-12-02, Lyndon Nerenberg wrote:
>this diminshes the uniqueness of the host part of the message-id.

It's the server/s FQDN, so why does it matter that the client
is using DHCP or not?

>I'm leaning towards taking out the recommendation, and instead say the

I would suggest not mucking with it.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 02 Dec 2001 23:09:08 -0700

> I would suggest not mucking with it.

 I tend to agree with Lyndon. Because challenge string is only used inside
MD5 (example from the draft below)
     MD5((tanstaaftanstaaf XOR opad),
               MD5((tanstaaftanstaaf XOR ipad),
               <[email-masked]>))

then it is irrelevant what format challenge has. This change allows
implementations to generate a more unpredictable challenge.

However I don't agree to impose any restrictions on length, as this will
make some existing implementations non compliant. This should be SHOULD,
not MUST.

Alexey Melnikov
__________________________________________
R & D, ACI Worldwide (formerly MessagingDirect Ltd.)
phone 780.424.4922 x357

I speak for myself only, not for my employer.
__________________________________________

---

From: Cyrus Daboo <[email-masked]>
Date: Mon, 03 Dec 2001 11:01:26 -0500

> characters. I would also like to impose a minimum length on the

The challenge is sent (and thus generated) by the server, so I don't see 
why the 'DHCP-ness' of the client is an issue. Certainly if the server does 
not have a unique hostname you may have an issue. Say the server is behind 
a firewall with NAT, then you might have [10.0.1.1] as part of the 
challenge. Is that what you are concerned with?

-- 
Cyrus Daboo

---

From: Lyndon Nerenberg <[email-masked]>
Date: Mon, 03 Dec 2001 11:53:23 -0700

> Certainly if the server does 

I was more concerned about the DHCP dynamics, however NAT could be
an issue as well.

--lyndon

---

From: Lyndon Nerenberg <[email-masked]>
Date: Mon, 03 Dec 2001 11:50:36 -0700

Sorry, I meant to say server, not client. In server environments
it's becoming more common to use DHCP configuration (e.g. ADSL and
cable modems). But if everyone thinks the status quo is fine I'll
leave it as is.

--lyndon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 03 Dec 2001 18:50:56 -0800

At 10:50 AM 2001-12-03, Lyndon Nerenberg wrote:
>But if everyone thinks the status quo is fine I'll
>leave it as is.

Unless there is consensus that the mechanism detailed in
RFC 2195 is broken, we shouldn't try to fix.

While it is clear that the mechanism has limited applicability,
I see no evidence that the mechanism is actually broken.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Dec 2001 20:03:10 -0800

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 02 Dec 2001 23:09:08 -0700

Alexey Melnikov

---

From: Cyrus Daboo <[email-masked]>
Date: Mon, 03 Dec 2001 11:01:26 -0500

-- 
Cyrus Daboo

---

From: Lyndon Nerenberg <[email-masked]>
Date: Mon, 03 Dec 2001 11:53:23 -0700

--lyndon

---

From: Lyndon Nerenberg <[email-masked]>
Date: Mon, 03 Dec 2001 11:50:36 -0700

--lyndon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 03 Dec 2001 18:50:56 -0800

Kurt