Subject: Encrypted Password

From: Jeffrey Stevens <[email-masked]>
Date: Tue, 23 Jun 1998 14:15:18 -0500

It is not required that the server send IBMSUBSPW in order to support
anything.  Servers can request individual USERVAR's if desired, or they can
simply request them all (and ignore any they do not support).  We always
request ALL the VAR's and USERVAR's (you see this just before the IAC SE
part).  Our Draft RFC shows what VAR's and USERVAR's we will support.

In actual implementation, we send out a special and unique USERVAR that has
"IBMRSEED" as a root name with a server seed string appended to it.  This
is technically a USERVAR request.  We do not actually send IBMRSEED or
IBMSUBSPW since the server has already requested the client send the value
under the global request for all USERVAR's.

Our documentation shows a legal exchange, even if the server does not
actually do it.

You will require at least 4 PTF's to install this NEW-ENVIRON option
support.  If the AS/400 Telnet server sends your client a "IAC DO
NEW-ENVIRON" request, then this support is running on that AS/400.  Refer
to Info APAR II10918 on the Client Access web page
http://www.as400.ibm.com/clientaccess for PTF numbers.

> Hi Jeffrey,
>
> In your example of an encrypted password:
>
>    AS/400 Telnet server             Enhanced Telnet client
>    --------------------------       -------------------------------
>    IAC DO NEW-ENVIRON          -->
>                                <--  IAC WILL NEW-ENVIRON
>    IAC SB NEW-ENVIRON SEND
>    USERVAR "IBMRSEEDxxxxxxxx"
>    USERVAR "IBMSUBSPW"
>    VAR USERVAR IAC SE          -->
>                                     IAC SB NEW-ENVIRON IS
>                                     VAR "USER" VALUE "DUMMYUSR"
>                                     USERVAR "IBMRSEED" VALUE "yyyyyyyy"
>                                     USERVAR "IBMSUBSPW" VALUE "zzzzzzzz"
>                                <--  IAC SE
>
> It shows the server sending: USERVAR "IBMSUBSPW".  In our tests we never see
> this USERVAR.  Does this uservar from the server tell the client that it is
> capable of password encryption?  If so, is there an OS/400 ptf that enables
> this capability?

--
J.S. (Jeffrey) Stevens      AS/400 TCP/IP          (Telnet/WSG/LPD)
Work:  [email-masked]        Personal:  [email-masked]