Re: Random data

[Kurt Zeilenga <[e-mail]>]

On 12 Aug 2008, at 8:21 AM, Tom Yu wrote:

>
> "Frank Ellermann" <[e-mail]> writes:
>
>> Tom Yu wrote:
>>
>>>> The right hand side of a challenge in "Message-ID format"
>>>> can be twisted into what I expect by an attacker, it's no
>>>> security feature.
>>
>>> Might this have been an aborted attempt at specifying how
>>> to use the challenge to transmit additional information to
>>> a server, such as channel binding information?  Or am I
>>> thinking of DIGEST?
>>
>> I'd guess that RFC 2195 uses the format of a Message-ID for
>> a challenge, because that's what APOP also uses, and a known
>> (for mail and news related protocols) concept.
>
> I meant that the introduction in draft-ietf-sasl-crammd5 of a new
> requirement that an implementation not interpret the "string that
> RFC2195 required to look like a RFC822 msg-id" might have been an
> aborted attempt to provide a "covert channel" for signaling the use of
> a channel binding.
>
> Alternatively, the new requirement that the client not interpret the
> challenge string might be an effort to improve interoperability with
> servers that do not send challenge strings that strictly conform to
> the syntax of RFC822 or RFC2822 msg-id strings.
>
> Authors or others, please elaborate if you recall the history of this
> change.
>

If I recall correctly, there was concern that some implementations  
might verify that string adheres to requirements that might placed  
upon msg-id strings in other situations.   The desire was to say that  
string has no semantical value.  Maybe there is a better way to say  
that...

-- Kurt