Re: Challenge-Response/OBI & S2ML (Anders Rundgren's suggestion)

[Anders Rundgren <anders.rundgren@telia.com>]

> I have reviewed all of your e-mails expressing concerns
> about not including Challenge-Response.
> 
> Overall, I agree with Phil's previous response:

Zahid,
That is not such a surprise as you are one of the S2ML authors :-)

You did however not respond to my request: Is this open for debate or is the
decision final?

Regarding the technical part of this, I suspect that we (all) may not even refer to the same
thing and the likely scenarious which makes it very hard for anyone to have an opinion above
the level "we must have this" or "this is out of scope".  It *is* fairly complicated.  It would be
interesting to know why MACE-Shibbeloth uses (sort of) C-A Auth if it is "redundant" (Bob, are there?)

If any *real* progress is to be made, a sub-commitee or ad-hoc group should be formed.

Regards
Anders