Re: Consensus call: the fate of CRAM-MD5

[Alexey Melnikov <[e-mail]>]

Simon Josefsson wrote:

>Tom Yu <[e-mail]> writes:
>
>  
>
>>Based on earlier mail from Lyndon and Alexey, I am initiating a
>>consensus call on the following points, which I hope are not
>>contentious, as I believe that they express the existing desires of
>>the Working Group:
>>
>>* Abandon work on draft-ietf-sasl-crammd5, removing it from the WG
>>  work list.  (de facto already done)
>>
>>* Leave the status of RFC 2195 (Proposed Standard) unchanged.
>>
>>* Adopt the SCRAM family as the successor to CRAM-MD5.
>>
>>* New work item: produce an Informational RFC documenting existing
>>  issues with CRAM-MD5.  This document could be based on
>>  draft-zeilenga-sasl-crammd5.
>>
>>* At some point in the future, probably after SCRAM is finished, move
>>  CRAM-MD5 to Historic status.
>>
>>Please comment before April 3.  We can discuss this at tomorrow's WG
>>session if necessary, but I do not want it to occupy a lot of session
>>time without good reason.
>>    
>>
>I agree.
>
>I believe the third point may be contentious, given John Kleinsin's
>comment at the appsarea meeting.  I don't think we need a decision that
>SCRAM will replace CRAM-MD5.
>
I agree.

>If we are successful, SCRAM will replace
>CRAM-MD5 in deployments.  If this does not succeed, it does not help
>that we say that SCRAM really does replace CRAM-MD5.
>
>I would support the plan without the third point too.
>  
>