Re: CNONCE: proposed resolution

Scott Lawrence wrote:
> 
> Paul Leach wrote:
> 
> > I think that absence of cnonce should be illegal if qop=auth or
> > qop=auth-int is selected by the client; if the client really _demands_
> > to be totally braindead, it can send a constant as its cnonce.
> 
> I'm also happy with that solution.

Just what does "illegal" mean?  What should a server do if it gets such
an "illegal" request?

Dave Kristol