Re: Digest mess
John Franks (john@math.nwu.edu)
Mon, 22 Dec 1997 14:16:06 -0600 (CST)
On Mon, 22 Dec 1997, Scott Lawrence wrote:
> Which leaves us with only whether or not to accept Pauls proposed
> change to use H(H(A1)) rather than H(A1).
>
One other question. Dave Kristol asked me what keeps a man in
the middle from stripping the digest from the response. I said
the digest-required field. But I'm not sure I'm right. It looks
like only the server can use digest-required now. Do we want to
let the client require a digest also? If so how?
John Franks
john@math.nwu.edu