CRAM-MD5: syntax for challenge

[Lyndon Nerenberg <[e-mail]>]

RFC2195 defines the challenge as having the syntax of a message-id,
and gives some guidance for building the contents. I don't think
the currently recommended scheme is as robust as it could be. Mobile
clients configured via DHCP tend to re-use hostnames and IP addresses;
this diminshes the uniqueness of the host part of the message-id. I'm
leaning towards taking out the recommendation, and instead say the
contents of the challenge must be a random sequence of printable
characters. I would also like to impose a minimum length on the
challenge.

--lyndon