Re: A dignified burial for CRAM-MD5

[Alexey Melnikov <[e-mail]>]

Lyndon Nerenberg wrote:

>
> Folks, it has been nearly a decade since the first move towards 
> re-stating CRAM-MD5 as a SASL mechanism. It's obvious now that this 
> will never happen.
>
> It's also obvious that CRAM-MD5 has entrenched itself to the point 
> where it's not going to go away any time soon (or late for that matter).
>
> The global base of interoperable deployments says we don't need to 
> issue a formal update to the specification. Frankly, anything that 
> fits inside two pages of text and works this well deserves to be left 
> well enough alone.
>
> Since the SASL WG can't come to an agreement about the status of 
> CRAM-MD5 -- other than it's adamantly opposed to its moving forward on 
> the standards track -- I think it's time for the WG to drop CRAM-MD5 
> from the work list. It's currently not a formal SASL mechanism, so 
> abandonment by the WG is a valid solution.
>
> This would leave RFC2195 in its present state, validating the existing 
> CRAM-MD5 deployments. Beside that, I'm proposing to put together a new 
> Informational RFC that documents the WGs concerns about the mechanism, 
> and addresses the interoperability issues. (Kurt's draft has done much 
> of this work already.)

This works for me.