Subject: Summary of opinions regarding the CRAM-MD5 I-D

From: Kurt Zeilenga <[email-masked]>
Date: Wed, 3 Sep 2008 10:54:31 -0700

In Pasi recently suggested to the chairs: "I believe it would be  
useful to post a message summarizing the WG members' opinions on draft- 
ietf-sasl-crammd5: who's happy with progressing the document basically  
as-is, and who is not?"

Most of the opinions I am aware of were stated under the belief that  
the I-D was going to progressed with a recommendation for publication  
on the Informational track.   I believe that most of the opinions in  
stated under an assumption that the document would be modified to  
state the Intended Category is "Informational", and that RFC 2195  
would be moved to Historic status, as indicated in my 6 Jun "Moving  
forward with CRAM-MD5".  So this summary is with this in mind.

I encourage clarification of one's own opinions in response to this  
message.  I intend to make a statement regarding WG consensus  
regarding this document before the week is out.

Lyndon Nerenberg has stated he is opposed to publishing the document  
off the standards track.  I believe he thinks portions of the document  
need some further work.

Frank Ellerman has expressed opposing opinions regarding the content  
of the document, as well as the publication on the Informational track.

Chris Newman opinion seems best reflected by his 23 Jun statement "I  
support any action which gets a CRAM-MD5 revision published..." and  
his 29 July statement "I would not break any consensus that involved  
publishing a revision of CRAM."

Sam Hartman opinion seems to be that CRAM-MD5 should be obsoleted.  He  
has stated he would not be part of any consensus to publish CRAM-MD5  
on the Standards Track.

Pasi Eronen made a narrow statement regarding intended track of the  
document that implies he leans towards Informational but that he can  
live with Standards Track.   It is unclear whether he has formed an  
opinion with regard to the content of the document.

Simon Josefsson appears to be of the opinion currently that the I-D  
needs some revision before progression.  I note that he has suggested  
that the document could be revised so that would be suitable for  
publication on the Standards Tracks.  He suggested the WG consider  
obsoleting CRAM-MD5.

Kurt Zeilenga has raised concerns with publishing the document  
"basically as-is" (as Informational).  He has suggested that the  
document could be changed so that it might be suitable for publication  
on the Standards Track but doubts that the WG has sufficient energy to  
do so and/or that the WG would find those such changes would be too  
disruptive to existing deployments.  He has also suggested the WG  
consider obsoleting CRAM-MD5.

---

From: "Alexey Melnikov" <[email-masked]>
Date: Thu, 4 Sep 2008 14:28:59 +0100

On Wed, Sep 3, 2008 at 6:54 PM, Kurt Zeilenga <[email-masked]>wrote:
>
> In Pasi recently suggested to the chairs: "I believe it would be useful to
> post a message summarizing the WG members' opinions on
> draft-ietf-sasl-crammd5: who's happy with progressing the document basically
> as-is, and who is not?"
>
> Most of the opinions I am aware of were stated under the belief that the
> I-D was going to progressed with a recommendation for publication on the
> Informational track.   I believe that most of the opinions in stated under
> an assumption that the document would be modified to state the Intended
> Category is "Informational", and that RFC 2195 would be moved to Historic
> status, as indicated in my 6 Jun "Moving forward with CRAM-MD5".  So this
> summary is with this in mind.
>
> message.  I intend to make a statement regarding WG consensus regarding this
> document before the week is out.

I prefer to publish the document. I think it should be Informational (I am
opposed to Standard Track) and have a warning saying that it only works for
US-ASCII usernames/passwords.

---

From: "Frank Ellermann" <[email-masked]>
Date: Sun, 7 Sep 2008 06:12:51 +0200

Kurt Zeilenga wrote:
 
> "basically as-is" (as Informational).  He has suggested that
> the document could be changed so that it might be suitable for
> publication on the Standards Track but doubts that the WG has
> sufficient energy to do so and/or that the WG would find those
> such changes would be too disruptive to existing deployments.

Two amendments:

- Simon's comparison of PLAIN and CRAM-MD5 was interesting.  It
  would be good to have this in the new RFC (independent of its
  status) as far as we can agree on the content.  This includes
  your explanation why PLAIN offers more flexibility wrt i18n.

- Related, the fate of SASLprep is crucial.  We have only one
  chance to get CRAM-MD5 i18n right.  We can't change our mind
  later (as it might be possible for PLAIN, or with yet another
  parameter for DIGEST-MD5).  Of course we could simply rename
  any SASL mechanism, and use new name to indicate a variation.

 Frank