Subject: S/KEY mechanism

From: John Gardiner Myers <[email-masked]>
Date: Tue, 5 Nov 1996 16:48:15 -0500 (EST)

I believe the base S/Key specification says to use MD4.

Actually, I've been considering removing the S/Key mechanism from the
base specification, possibly doing an OTP mechanism later.  OTP
carries information on the hash algorithm used, and there is an OTP
rekeying mechanism, which will be necessary for using it with
protocols (such as IMAP and SMTP) which treat connections as being
relatively cheap.

-- 
_.John Gardiner Myers	Internet: [email-masked]
			LoseNet:  ...!seismo!ihnp4!wiscvm.wisc.edu!give!up

---

From: "Jack De Winter" <[email-masked]>
Date: Tue, 05 Nov 1996 18:02:59 -0500

>protocols (such as IMAP and SMTP) which treat connections as being

Actually, the way it is specified in the current SASL draft can
lead on to believe that there are implmentations out there that
use SKEY with MD5, and makes mention of this in the spec.  But it
leaves a lot of ambiguity in the document about whether or not
MD5 is valid with SKEY, and if so, makes no allowance to allow for
differentiating SKEY based on MD5.

regards,
Jack

---

From: "Jack De Winter" <[email-masked]>
Date: Tue, 05 Nov 1996 18:10:59 -0500

OTP?  And rekeying?

regards,
Jack