A dignified burial for CRAM-MD5

[Lyndon Nerenberg <[e-mail]>]

Folks, it has been nearly a decade since the first move towards re-stating 
CRAM-MD5 as a SASL mechanism. It's obvious now that this will never 
happen.

It's also obvious that CRAM-MD5 has entrenched itself to the point where 
it's not going to go away any time soon (or late for that matter).

The global base of interoperable deployments says we don't need to 
issue a formal update to the specification. Frankly, anything that fits 
inside two pages of text and works this well deserves to be left well 
enough alone.

Since the SASL WG can't come to an agreement about the status of CRAM-MD5 
-- other than it's adamantly opposed to its moving forward on the 
standards track -- I think it's time for the WG to drop CRAM-MD5 from the 
work list. It's currently not a formal SASL mechanism, so abandonment by 
the WG is a valid solution.

This would leave RFC2195 in its present state, validating the existing 
CRAM-MD5 deployments. Beside that, I'm proposing to put together a new 
Informational RFC that documents the WGs concerns about the mechanism, and 
addresses the interoperability issues. (Kurt's draft has done much of this 
work already.)

--lyndon