Subject: A dignified burial for CRAM-MD5

From: Lyndon Nerenberg <[email-masked]>
Date: Wed, 18 Feb 2009 20:35:36 -0800 (PST)

Folks, it has been nearly a decade since the first move towards re-stating 
CRAM-MD5 as a SASL mechanism. It's obvious now that this will never 
happen.

It's also obvious that CRAM-MD5 has entrenched itself to the point where 
it's not going to go away any time soon (or late for that matter).

The global base of interoperable deployments says we don't need to 
issue a formal update to the specification. Frankly, anything that fits 
inside two pages of text and works this well deserves to be left well 
enough alone.

Since the SASL WG can't come to an agreement about the status of CRAM-MD5 
-- other than it's adamantly opposed to its moving forward on the 
standards track -- I think it's time for the WG to drop CRAM-MD5 from the 
work list. It's currently not a formal SASL mechanism, so abandonment by 
the WG is a valid solution.

This would leave RFC2195 in its present state, validating the existing 
CRAM-MD5 deployments. Beside that, I'm proposing to put together a new 
Informational RFC that documents the WGs concerns about the mechanism, and 
addresses the interoperability issues. (Kurt's draft has done much of this 
work already.)

--lyndon

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 27 Feb 2009 16:34:15 +0000

Lyndon Nerenberg wrote:

>
> Folks, it has been nearly a decade since the first move towards 
> re-stating CRAM-MD5 as a SASL mechanism. It's obvious now that this 
> will never happen.
>
> It's also obvious that CRAM-MD5 has entrenched itself to the point 
> where it's not going to go away any time soon (or late for that matter).
>
> issue a formal update to the specification. Frankly, anything that 
> fits inside two pages of text and works this well deserves to be left 
> well enough alone.
>
> Since the SASL WG can't come to an agreement about the status of 
> CRAM-MD5 -- other than it's adamantly opposed to its moving forward on 
> the standards track -- I think it's time for the WG to drop CRAM-MD5 
> from the work list. It's currently not a formal SASL mechanism, so 
> abandonment by the WG is a valid solution.
>
> Informational RFC that documents the WGs concerns about the mechanism, 
> and addresses the interoperability issues. (Kurt's draft has done much 
> of this work already.)

This works for me.