Re: Authentication

[Dave Katz <[e-mail]>]

On Mar 17, 2005, at 7:08 AM, Chris Nogradi wrote:

> Dave,
>
> I just noticed that you have added the following sentence to the base 
> draft in
> section 6.6:
>
> "Implementations MUST support SHA1 authentication.  Other froms of
> authentication are optional."
>
> Since you did not make mention of this in the document changes 
> sections, I
> assume that this does not mean that all implementations must support 
> at least
> this form of authentication.  Is the purpose of this sentence to say 
> that if
> an implementation uses authentication, it must support SHA1?

Sorry, I forgot to list that in the changes.

This is in there because the IESG will not allow the document to 
advance without it.  It's an interesting question as to whether they 
would allow the spec to say that an implementation could have no 
authentication at all;  my guess is that their stand is that the spec 
must require that all implementations support SHA1 authentication.

I also expect that vendors will make their own choices, as there is no 
significant difference between an implementation in which nobody turns 
on authentication and an implementation that does not even include it.

But that's the word from on high.

>
> BTW, there is a typo in this sentence as it should say "forms" instead 
> of
> "froms".

Thanks...

--Dave