Re: CRAM-MD5: syntax for challenge

["Kurt D. Zeilenga" <[e-mail]>]

At 07:15 PM 2001-12-02, Lyndon Nerenberg wrote:
>RFC2195 defines the challenge as having the syntax of a message-id,
>and gives some guidance for building the contents. I don't think
>the currently recommended scheme is as robust as it could be. Mobile
>clients configured via DHCP tend to re-use hostnames and IP addresses;
>this diminshes the uniqueness of the host part of the message-id.

It's the server/s FQDN, so why does it matter that the client
is using DHCP or not?

>I'm leaning towards taking out the recommendation, and instead say the
>contents of the challenge must be a random sequence of printable
>characters. I would also like to impose a minimum length on the
>challenge.

I would suggest not mucking with it.

Kurt