Re: authmeth: removal of DIGEST-MD5

I've added this security consideration in response to your note below:
 
6.3.4. Hashed Password Security Considerations
 
Some authentication mechanisms (e.g. DIGEST-MD5) transmit a hash of the
password value that may be vulnerable to offline dictionary attacks. 
Implementers should take care to protect such hashed password values
during transmission using mechanisms similar to those suggested for
protecting clear text passwords.
 
Roger

>>> "Kurt D. Zeilenga" <[email protected]> 10/13/2005 1:54 pm >>>
At 12:27 PM 10/13/2005, Hallvard B Furuseth wrote:
>CRAM-MD5 seems to be the only alternative mechanism which is widely
>enough deployed to suggest now.  That mechanism apparently has its
own
>problems, though.  So I suggest to keep the DIGEST-MD5 reference. 

I note that while CRAM-MD5 and DIGEST-MD5 don't expose the
actual password, they do expose a hash of that password that
is quite prone to offline dictionary attacks.  I'd argue
that you need to be just as careful as to whom you give
that hash to as you are giving out the actual password.

Kurt