[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: RFC2256: userPassword

At 08:53 AM 6/30/99 -0700, David Boreham wrote:
>Helmut Volpers wrote:
>
>> perhaps I missed something, do you think microsoft, netscape
>> innosoft, ibm, siemens etc have to use the same one way encryption
>> algorithm, or do you mean every client should use the same
>> encryption algorithm and the server only make the compare ?
>
>If servers are participating in a replication agreement,
>they must implement all the hashing schemes employed.
>(same things applies to access control and schema
>and a bunch of other things, of course).
>
>Netscape implements a set of standard hashes
>including SHA-1 and crypt. Some other vendors
>support one or more of these hashing functions. 

OpenLDAP provides these as well as MD5 and salted
versions SHA-1 and MD5 hashes.  I suspect other
algorithms will be added.

I believe it wise to formalize a mechanism
to exchange hashed password values.  I would
suggest that such include a mechanism for client
discovery of hash algorithms supported by the server
and/or discovery of whether the server can and
will perform hash generation when a cleartext
password value is set.

Kurt