RE: RFC2256: userPassword

[Paul Leach <paulle@microsoft.com>]

> >>Your decorated hash values don't do the client any good if he only
> >>has Compare access and not Read access - how does the 
> client find out
> >>which hash is in use? It seems to me that client-side validation is
> >>really precluded here.

And a good thing, too. I'll assert that any scheme for client side
validation (that we've discussed here) is too insecure.

The client can validate the password by using it to try to make an
authenticated connection to the server.

Paul