RE: RFC2256: userPassword

[Howard Chu <hyc@symas.com>]

> Mark,
> 	Of course.  I agree completely and was not suggesting
> that passwords be in the clear inside of the the directory.
> However I go a step further and note that having easily
> decrypted (i.e. hashed) passwords in the directory is not
> significantly more secure against attacks, just (as you note)
> against accidental exposure.
> 
> 	Before security can be built into a system people
> have to agree what is being secured, and what it's being
> secured against.

Of course, even agreeing that strong encryption must be used doesn't
really solve the problem. How do you store the key that's used to encrypt
the userPassword? This is a part of X.500's encrypted attributes that I
never quite got the hang of...