Subject: [Simple] MSRP: Authentication and Relays

From: Adam Roach <[email-masked]>
Date: Thu, 04 Aug 2005 07:30:58 -0500

To make sure everyone is aware: the most recent draft of the MSRP relay 
draft defines Digest authentication instead of Basic authentication, and 
has a discussion of the security properties that arise from this change.

If you have any interest in this topic, please go read 
draft-ietf-simple-msrp-relays-05 and make comments as necessary.

/a

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Dave Cridland <[email-masked]>
Date: Thu, 04 Aug 2005 15:29:05 +0100

On Thu Aug  4 03:30:58 2005, Adam Roach wrote:
> To make sure everyone is aware: the most recent draft of the MSRP 
> relay draft defines Digest authentication instead of Basic 
> authentication, and has a discussion of the security properties 
> that arise from this change.

FYI, there was lots of concerns raised about DIGEST-MD5 (SASL's 
version of Digest auth) and MD5 based authentication mechanisms in 
general at the IETF, in particular at the Apps open area meeting and 
both the SASL meeting and the Security Area meeting. It would appear 
that usage of both Digest *and* TLS might well be the best way, but 
quite honestly I'm a little unclear on the results of the discussion.

Dave.

---

From: Adam Roach <[email-masked]>
Date: Sun, 07 Aug 2005 18:41:18 -0500

Dave Cridland wrote:

>> authentication, and has a discussion of the security properties that 
>> arise from this change.
>
>

And that is exactly what is specified in the current draft. Thanks.

/a