search for: rfc2945

G'day, First off, I'm not subscribed to the list, so if there are any responses that should be directed to me, feel free to CC me in :) The below url is an updated patch of Professor Tom's earlier SRP patches for SSH. The only things changed was so that it would compile on a newer openssh version. For more information regarding SRP, see http://srp.stanford.edu This isn't

free, and both myself and the Stanford OTL have been responsive to any questions that might arise. The OpenSSH patches are clearly RFC2945-based, and are unambiguously royalty-free. Isn't this exactly what you praised USC and Xerox for just a moment ago? > The other technologies are well established, and we are protected by the > entire industry. And it seems you are unwilling to allow SRP that same opportunity to become...

>Simply stated, SRP is a strong password authentication protocol that >resists passive/active network attack, and when used in conjunction with >OpenSSH, solves the "unknown host key" problem without requiring host >key fingerprint verification or PKI deployment (e.g. X.509 certs). Put >another way, is there any good reason *not* to fold these patches into >OpenSSH