Subject: Working Example of Encrypted Password

From: Jeffrey Stevens <[email-masked]>
Date: Thu, 18 Jun 1998 18:40:12 -0500

At the TN3270e/TN5250e Interoperability Event, 6/1-6/3 held in IBM Raleigh,
Barry Hansen (WRQ) requested an example of using/setting the IBMRSEEDxxxx
information.  We have agreed to supply a working example in our RFC for
development/testing purposes so that clients may validate themselves
against the Telnet server. The following negotiation will be used in the
next incantation of the RFC TN5250E Draft, which can be found at the link
http://www.ietf.org/ids.by.wg/tn3270e.html.

   The following illustrates the encrypted case:

   AS/400 Telnet server             Enhanced Telnet client
   --------------------------       -------------------------------
   IAC DO NEW-ENVIRON          -->
                               <--  IAC WILL NEW-ENVIRON
   IAC SB NEW-ENVIRON SEND
   USERVAR "IBMRSEEDxxxxxxxx"
   USERVAR "IBMSUBSPW"
   VAR USERVAR IAC SE          -->
                                    IAC SB NEW-ENVIRON IS
                                    VAR "USER" VALUE "DUMMYUSR"
                                    USERVAR "IBMRSEED" VALUE "yyyyyyyy"
                                    USERVAR "IBMSUBSPW" VALUE "zzzzzzzz"
                               <--  IAC SE
                                .
                                .
   (other negotiations)         .

   In this example, "xxxxxxxx" is an 8-byte hexadecimal random server
   seed, "yyyyyyyy" is an 8-byte hexadecimal random client seed and
   "zzzzzzzz" is an 8-byte hexadecimal encrypted password.  If the
   password is not valid, then the sign-on panel is displayed.  If the
   password is expired, then the Change Password panel is displayed.

   Actual bytes transmitted in the above example are shown in hex below,
   where the server seed is "7D3E488F18080404", the client seed is
   "4E4142334E414233" and the encrypted password is "DFB0402F22ABA3BA".
   The user profile used to generate the encrypted password is
   "44554D4D59555352" (DUMMYUSR), with a clear-text password of
   "44554D4D595057" (DUMMYPW).

   AS/400 Telnet server             Enhanced Telnet client
   --------------------------       -------------------------
   FF FD 27                    -->
                               <--  FF FB 27
   FF FA 27 01 03 49 42 4D
   52 53 45 45 44 7D 3E 48
   8F 18 08 04 04 03 49 42
   4D 53 55 42 53 50 57 03
   00 FF F0                    -->
                                    FF FA 27 00 00 55 53 45
                                    52 01 44 55 4D 4D 59 55
                                    53 52 03 49 42 4D 52 53
                                    45 45 44 01 4E 41 42 33
                                    4E 41 42 33 03 49 42 4D
                                    53 55 42 53 50 57 01 DF
                                    B0 40 2F 22 AB A3 BA FF
                               <--  F0

   The following illustrates the clear-text case:

   AS/400 Telnet server             Enhanced Telnet client
   --------------------------       -------------------------
   IAC DO NEW-ENVIRON          -->
                               <--  IAC WILL NEW-ENVIRON
   IAC SB NEW-ENVIRON SEND
   USERVAR "IBMRSEEDxxxxxxxx"
   USERVAR "IBMSUBSPW"
   VAR USERVAR IAC SE          -->
                                    IAC SB NEW-ENVIRON IS
                                    VAR "USER" VALUE "DUMMYUSR"
                                    USERVAR "IBMRSEED" VALUE
                                    USERVAR "IBMSUBSPW" VALUE "yyyyyyyy"
                               <--  IAC SE
                                .
                                .
   (other negotiations)         .

   In this example, "xxxxxxxx" is an 8-byte hexadecimal random server
   seed, "yyyyyyyyyy" is a 10-byte us-ascii client clear-text password.
   If the password has expired, then the sign-on panel is displayed.

   Actual bytes transmitted in the above example are shown in hex below,
   where the server seed is "7D3E488F18080404", the client seed is empty
   and the clear-text password is "44554D4D595057" (DUMMYPW).  The user
   profile used is "44554D4D59555352" (DUMMYUSR).

  AS/400 Telnet server             Enhanced Telnet client
  --------------------------       -------------------------
  FF FD 27                    -->
                              <--  FF FB 27
  FF FA 27 01 03 49 42 4D
  52 53 45 45 44 7D 3E 48
  8F 18 08 04 04 03 49 42
  4D 53 55 42 53 50 57 03
  00 FF F0                    -->
                                   FF FA 27 00 00 55 53 45
                                   52 03 44 55 4D 4D 59 55
                                   53 52 03 49 42 4D 52 53
                                   45 45 44 01 03 49 42 4D
                                   53 55 42 53 50 57 01 44
                              <--  55 4D 4D 59 50 57 FF F0

Robert afSandeberg wrote:
>
> [email-masked] on 04/21/98 06:03:03 PM
> Please respond to [email-masked]
> To: [email-masked]
> cc:
> Subject: Re: Password encryption for TN5250 Enhancements
>
> Hi,
>
> I would like to get some clarification on how to encrypt passwords to the
> AS/400.  I am using IBMRSEEDxxxxxxxx to try to accomplish this.  I copied my
> code from our MPTN emulator, where the password appears to be workin.
>
> Some examples on how to do this correctly would be greatly appreciated.
>
> Robert afSandeberg
> [email-masked]

--
J.S. (Jeffrey) Stevens      AS/400 TCP/IP          (Telnet/WSG/LPD)
Work:  [email-masked]        Personal:  [email-masked]

---

From: Jeffrey Stevens <[email-masked]>
Date: Tue, 30 Jun 1998 11:32:18 -0500

I have a typo in my reply to the list where I incorrectly used a 0x03
(USERVAR) byte at offset 10 when I should have used 0x01 byte (VALUE).
This is the corrected hex dump:

                                    FF FA 27 00 00 55 53 45
                                    52 01 44 55 4D 4D 59 55
                                    53 52 03 49 42 4D 52 53
                                    45 45 44 01 03 49 42 4D
                                    53 55 42 53 50 57 01 44

My apologies for the confusion...I have corrected this typo in the Draft
RFC which we will be re-posting with updates in the future.  My thanks to
those dedicated group members who brought this to my attention!