Subject: Re: Working Example of Encrypted Password

From: David Borman <[email-masked]>
Date: Tue, 30 Jun 1998 13:02:54 -0500 (CDT)

Hi all,

I watch this list, but usually don't get involved.  However, I
noticed this:

>    The following illustrates the encrypted case:
>
>    AS/400 Telnet server             Enhanced Telnet client
>    --------------------------       -------------------------------
>    IAC DO NEW-ENVIRON          -->
>                                <--  IAC WILL NEW-ENVIRON
>    IAC SB NEW-ENVIRON SEND
>    USERVAR "IBMRSEEDxxxxxxxx"
>    USERVAR "IBMSUBSPW"
>    VAR USERVAR IAC SE          -->

I'd like to point out that the difference between "VAR" and "USERVAR"
is that "VAR" is reserved for well known variable names.  From RFC 1572,

   Because it is impossible to anticipate all variables that users may
   wish to exchange, the USERVAR type is provided to allow users to
   transmit arbitrary variable/value pairs.  The use of an additional
   type allows implementations to distinguish between values derived by
   the remote host software and values supplied by the user.  Paranoid
   implementations will most likely treat both types with an equal level
   of distrust.  The results of a name-space collision between a well-
   known and a user variable are implementation specific.

Any environment variables that are documented in an RFC should probably
be of type VAR, not type USERVAR, unless there is a strong reason for
leaving them type USERVAR.

Just my $.02

                        -David Borman, [email-masked]

---

From: Jeffrey Stevens <[email-masked]>
Date: Tue, 30 Jun 1998 18:52:29 -0500

Hi Dave,

This is interesting, are you suggesting IBMSUBSPW, etc. should be VAR type?

RFC 1572 cites as well-known VAR's the following:  USER, JOB, ACCT,
PRINTER, SYSTEMTYPE and DISPLAY.  We took this to mean this is the list of
well-known VAR's was already defined, and anything else we wanted to use
had to be USERVAR type.  So, our Draft TN5250E RFC only uses the VAR named
USER, and calls everything else we use a USERVAR.

--
J.S. (Jeffrey) Stevens      AS/400 TCP/IP          (Telnet/WSG/LPD)
Work:  [email-masked]        Personal:  [email-masked]