It is proposed to add the new user token - username password facet to the core server facet. My understanding is that this functionality was present in the core server facet historically. Previously it was acceptable to send the password unencrypted over a connection even when using an insecure channel. This is important as it allows the deployment of Micro and Nano Embedded Device Servers that do not contain any PKI functionality.

Looking at Part 4 it seems that there is some ambiguity over whether or not the password must be encrypted with some text stating "shall" and some text stating "should".

We need to ensure that if this functionality is going to be retained in the Core Server Facet that servers can still send passwords in clear text over insecure connections, otherwise many deployed servers will be made non-compliant. Most OEMs implementing Micro and Nano embedded device servers do not want to support PKI infrastructure within these servers at present. These servers are no less secure than the many field bus installations that they replace or complement.

Please clarify the language in part 4 to make it clear that while not recommended, it is acceptable to send unencrypted passwords over insecure connections.