Subject: CRAM-MD5: syntax for challenge

From: Lyndon Nerenberg <[email-masked]>
Date: Sun, 02 Dec 2001 20:15:33 -0700

RFC2195 defines the challenge as having the syntax of a message-id,
and gives some guidance for building the contents. I don't think
the currently recommended scheme is as robust as it could be. Mobile
clients configured via DHCP tend to re-use hostnames and IP addresses;
this diminshes the uniqueness of the host part of the message-id. I'm
leaning towards taking out the recommendation, and instead say the
contents of the challenge must be a random sequence of printable
characters. I would also like to impose a minimum length on the
challenge.

--lyndon