Linus Nordberg linus@nordberg.se writes:

We need a way to express which sender/recipient pair a given XHASHCASHAUTH is authenticating, in the case of multiple RCPT TO.

Correct, when moving the XHASHCASH* things before RCPT TO, more information must be provided by the client.

And it applies not only to authentication, but also to challenge response (since the salt/resource/hashcash input depends on the recipient).

/Niels