On Thu, 2011-06-09 at 13:48 +0530, kenja heramba wrote:> Hi,
>
> I am writing a Pop3Client. I use dovecot server as POP3 server in linux and
> hMailServer in windows.
>
> I was just testing digest-md5 auth with dovecot server.
>
> I had an observation.
>
> After server side verification, server sends a verification code to client.
> If this fails, how can client send the negative response or does it not
> exist?
It doesn't exist. What could the client do anyway? Tell the server that
"I see you're doing a man-in-the-middle attack, no thanks"?
> When I see packet capture, dovecot server sends +OK Logged in for anything
> client sends.
The last thing a client sends is the verification checksum, which
finishes the DIGEST-MD5 authentication. After that the login is
complete. So I'm not sure what you mean by "anything client
sends". If
you send a wrong checksum, it should fail the authentication.