Subject: <msg-id> in CRAM-MD5

From: Lyndon Nerenberg <[email-masked]>
Date: Thu, 08 Jul 2004 18:40:33 -0700

--On 2004-3-10 11:31 PM -0800 "Kurt D. Zeilenga" <[email-masked]> 
wrote:

> Why isn't RFC-822 msg-id production here as was done in RFC 2195?
> The production below is quite different than a msg-id (in some
> ways more restrictive and in other ways less restrictive).
>
> For compatibility with existing RFC 2195, I think this specification
> should simple incorporate (directly or by reference) the msg-id
> production previously used.

There is a problem here. RFC2822 states:

  msg-id = [CFWS] "<" id-left "@" id-right ">" [CFWS]

If we reference 822 for <msg-id>, people are going to assume the 2822 
definition replaces it. Suddenly we have these [CFWS] tokens muddying 
things up.

The <msg-id> format for the challenge reflects directly on CRAM's birth 
in an email environment. Since email software already had to deal with 
generating unique message ids, re-using that code as a source for 
unique strings made sense at the time. But the important property of 
the challenge is that it be unique, not that it syntactically resemble 
a <msg-id> element. So relaxing the formatting requirement to simplify 
the grammar should be fine, provided the new production does not 
syntactically invalidate existing implementations. Therefore, I'm 
proposing that we change the syntax of the challenge to:

  challenge = "<" 3*( %21-3B / %3D / %3F-7E ) ">"
              ; a bracketed string of printing characters, not
              ; containing embedded "<" or ">"

and modify the text to emphasize the importance of generating unique 
challenges, making reference to the historical behaviour.

--lyndon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 09 Jul 2004 12:25:04 -0700

At 06:40 PM 7/8/2004, Lyndon Nerenberg wrote:

>--On 2004-3-10 11:31 PM -0800 "Kurt D. Zeilenga" <[email-masked]> wrote:
>
>If we reference 822 for <msg-id>, people are going to assume the 2822 definition replaces it. Suddenly we have these [CFWS] tokens muddying things up.
>
>The <msg-id> format for the challenge reflects directly on CRAM's birth in an email environment. Since email software already had to deal with generating unique message ids, re-using that code as a source for unique strings made sense at the time. But the important property of the challenge is that it be unique, not that it syntactically resemble a <msg-id> element. So relaxing the formatting requirement to simplify the grammar should be fine, provided the new production does not syntactically invalidate existing implementations. Therefore, I'm proposing that we change the syntax of the challenge to:
>
>and modify the text to emphasize the importance of generating unique challenges, making reference to the historical behaviour.

Seems reasonable to me.

Kurt

---

From: Lyndon Nerenberg <[email-masked]>
Date: Fri, 09 Jul 2004 14:13:00 -0700

>> challenges, making reference to the historical behaviour.

Excellent. I've sent version -03 of the draft off for publication. The 
major changes from -02 are:

- reformatted and edited to put it into the style the RFC Editor 
prefers;

- <challenge> mods as described (explanitory text still to come);

- new and updated examples from Simon. It would be useful if someone 
could contribute an ACAP example (or some other non-IMAP example, and 
which doesn't base64 encode parts of the exchange);

- addressed *most* of Kurt's review comments from his March 10 message 
to the list.

Still to be done:

- Changes from RFC2195;

- the Abstract and Introduction still need work;

- text rational for <challenge>: uniqueness property and historical 
behaviour (and probably a short paragraph under Security 
Considerations).

--lyndon

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 16 Jul 2004 14:42:13 +0100

>>> challenges, making reference to the historical behaviour.
I am glad about this change, I've been advocating something similar before.

Alexey

---

From: Lyndon Nerenberg <[email-masked]>
Date: Thu, 08 Jul 2004 18:40:33 -0700

--lyndon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 09 Jul 2004 12:25:04 -0700

Seems reasonable to me.

Kurt

---

From: Lyndon Nerenberg <[email-masked]>
Date: Fri, 09 Jul 2004 14:13:00 -0700

Still to be done:

- Changes from RFC2195;

--lyndon

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 16 Jul 2004 14:42:13 +0100

Alexey