Re: CRAM-MD5: syntax for challenge

[Cyrus Daboo <[e-mail]>]

--On Sunday, December 2, 2001 8:15 PM -0700 Lyndon Nerenberg 
<[e-mail]> wrote:

> RFC2195 defines the challenge as having the syntax of a message-id,
> and gives some guidance for building the contents. I don't think
> the currently recommended scheme is as robust as it could be. Mobile
> clients configured via DHCP tend to re-use hostnames and IP addresses;
> this diminshes the uniqueness of the host part of the message-id. I'm
> leaning towards taking out the recommendation, and instead say the
> contents of the challenge must be a random sequence of printable
> characters. I would also like to impose a minimum length on the
> challenge.

The challenge is sent (and thus generated) by the server, so I don't see 
why the 'DHCP-ness' of the client is an issue. Certainly if the server does 
not have a unique hostname you may have an issue. Say the server is behind 
a firewall with NAT, then you might have [10.0.1.1] as part of the 
challenge. Is that what you are concerned with?

-- 
Cyrus Daboo