Christian Huitema wrote: > yes, DIGEST-MD5 has essentially the same issue. If the SASL folks want their very own "decruft" experiment they'd have to update RFCs 2244, 2645, 3013 (a BCP), check ESMTPA in 3848, do something about 2617, and probably some more RFCs. DIGEST-MD5 and OTP are registered as "common", not only "limited" like CRAM-MD5. Frank _______________________________________________ Ietf@xxxxxxxx https://www1.ietf.org/mailman/listinfo/ietf