RFC 1416

Telnet Authentication Option

📅 published February 1993, from ietf

Part 1 of 2 🎀 (more coming, bestie, so stay tuned!)

RFC 1416: Telnet Authentication Option 💖

Network Working Group, Request for Comments: 1416 📜
Author: David A. Borman, Editor, at Cray Research, Inc. 🖋️
Category: Experimental Protocol 🧪 (so it's experimental, not a finished standard)
Date: February 1993 📅
Obsoletes: RFC 1409 🙅 (this one replaces it)

Status of this Memo 📣

Okay, so this memo defines an Experimental Protocol for the Internet community. They want discussion and suggestions for improvement, so feedback is welcome 🫶 For the standardization state and status of this protocol, check the current edition of the "IAB Official Protocol Standards." Distribution of this memo is unlimited 🌈

Note 📝

This RFC 1416 replaces RFC 1409. RFC 1409 had a typo in its example on page 6: one REPLY should have been IS 🙈

1. Command Names and Codes ✨

Here's the full cast of characters: every command name, authentication type, and modifier, with its number 🦋

AUTHENTICATION  37
    IS               0
    SEND             1
    REPLY            2
    NAME             3

    Authentication Types
    NULL             0
    KERBEROS_V4      1
    KERBEROS_V5      2
    SPX              3
    RSA              6
    LOKI            10

    Modifiers
    AUTH_WHO_MASK        1
    AUTH_CLIENT_TO_SERVER    0
    AUTH_SERVER_TO_CLIENT    1
    AUTH_HOW_MASK        2
    AUTH_HOW_ONE_WAY         0
    AUTH_HOW_MUTUAL          2

2. Command Meanings 💅

Okay bestie, this doc talks about a "server" and a "client" a lot, so here's the tea. The "server" is the side of the connection that did the passive TCP open (TCP LISTEN state). The "client" is the side that did the active open. Got it? 💜

`IAC WILL AUTHENTICATION`

The client side sends this to say it's willing to send and receive authentication info 🙋

`IAC DO AUTHENTICATION`

The server side sends this to say it's willing to send and receive authentication info 🙌

`IAC WONT AUTHENTICATION`

The client side sends this to say it refuses to send or receive authentication info. The server side sends this one if it gets a DO AUTHENTICATION command. Not it, bestie 🙅

`IAC DONT AUTHENTICATION`

The server side sends this to say it refuses to send or receive authentication info. The client side sends this one if it gets a WILL AUTHENTICATION command 💀

SEND

IAC SB AUTHENTICATION SEND authentication-type-pair-list IAC SE

The server is asking for authentication info for one of the types in the "authentication-type-pair-list." That list is an ordered list of "authentication-type" pairs. Only the server side (DO AUTHENTICATION) is allowed to send this one 🎯

IS

IAC SB AUTHENTICATION IS authentication-type-pair <auth data> IAC SE

The client is sending its authentication info for the "authentication-type-pair." Only the client side (WILL AUTHENTICATION) is allowed to send this one ✨

REPLY

IAC SB AUTHENTICATION REPLY authentication-type-pair <auth data> IAC SE

The server is replying to the authentication info it got in an earlier IS command. Only the server side (DO AUTHENTICATION) is allowed to send this one 💖

NAME

IAC SB AUTHENTICATION NAME remote-user IAC SE

This one is optional 🌸 It says which account name on the remote host the user wants to be authorized to use. Heads up: authentication can succeed while the authorization to use that particular account still fails. Some authentication mechanisms may ignore this command 🙈

The "authentication-type-pair" is two octets. The first is the authentication type (as listed in Section 1, and additions to that list must be registered with the Internet Assigned Numbers Authority (IANA)). The second is a modifier to that type. Right now there are two one-bit fields in the modifier, the AUTH_WHO_MASK bit and the AUTH_HOW_MASK bit, so there are four possible combos 🧩

AUTH_CLIENT_TO_SERVER
AUTH_HOW_ONE_WAY

The client sends authentication info about the local user to the server. If the negotiation works, the server has authenticated the user on the client side of the connection 🔐

AUTH_SERVER_TO_CLIENT
AUTH_HOW_ONE_WAY

The server authenticates itself to the client. If the negotiation works, the client knows it's connected to the server it wants to be connected to 🦋

AUTH_CLIENT_TO_SERVER
AUTH_HOW_MUTUAL

The client sends authentication info about the local user to the server, and then the server authenticates itself to the client. If the negotiation works, the server has authenticated the user on the client side of the connection, and the client knows it's connected to the server it wants to be connected to 👑

AUTH_SERVER_TO_CLIENT
AUTH_HOW_MUTUAL

The server authenticates itself to the client, and then the client authenticates itself to the server. If the negotiation works, the client knows it's connected to the server it wants, and the server knows the client is who it claims to be 🫶

3. Default Specification 🦋

The default for this option is:

WONT AUTHENTICATION
DONT AUTHENTICATION

Which means there isn't any exchange of authentication information at all 😌

4. Motivation 🌸

Okay, so one of the big problems with Telnet is that to log into remote systems, you have to type your password, and it goes across the network in clear text. If the connection goes through untrusted networks, someone watching the packets go by could steal your password 😭

That's where the AUTHENTICATION option comes in. Its whole purpose is to give us a framework for passing authentication info through the TELNET session. That means two things: 1) the user's password never gets sent across the network in clear text, and 2) if the front end telnet process already has the right authentication info, it can send it automatically, so the user doesn't have to type any password at all 🔑

It's meant to be general enough to pass information for any authentication system. Very flexible, very cute 🌈

5. Security Implications 🚨

Being able to negotiate a common authentication mechanism between client and server is a feature of the authentication option, and it should be used with caution. ⚠️ Here's why this is serious: when the negotiation happens, no authentication has happened yet. So each system has no way of knowing whether it's talking to the system it intends to talk to. An intruder could try to negotiate an authentication system that is either weak or already compromised by the intruder 💀

6. Implementation Rules 🔥

WILL and DO are only used at the very beginning of the connection, to ask for and grant permission for future negotiations 🤝

Authentication is only negotiated in one direction. The server must send the DO, and the client must send the WILL. This restriction exists because of how authentication works: there are three possible cases, which are server authenticates client, client authenticates server, and server and client authenticate each other. By only negotiating the option in one direction, and then figuring out which of the three cases is in play using the suboption, any potential ambiguity goes away 🧠 If the server receives a DO, it must respond with a WONT. If the client receives a WILL, it must respond with a DONT 🙅

Once the two hosts have swapped a DO and a WILL, the server is free to request authentication info. In that request, a list of supported authentication types gets sent. Only the server may send requests (IAC SB AUTHENTICATION SEND authentication-type-pair-list IAC SE). Only the client may transmit authentication info, using IAC SB AUTHENTICATION IS authentication-type ... IAC SE. Only the server may send replies (IAC SB AUTHENTICATION REPLY authentication-type ... IAC SE). As many IS and REPLY suboptions can be exchanged as the chosen authentication scheme needs 💅

If the client doesn't support any of the authentication types in the authentication-type-pair-list, a type of NULL should be used to show that in the IS reply. Keep in mind that in this case, the server may choose to close the connection 🥺

The order of the authentication types MUST be set to show preference for different authentication types, with the first type being the most preferred and the last type the least preferred 👑

Chair's Address 💌

okay so if you want to reach the working group, the move is to contact the current chair 🫶✨ and that's Steve Alexander at INTERACTIVE Systems Corporation. here's where to find him:

Steve Alexander
INTERACTIVE Systems Corporation
1901 North Naper Boulevard
Naperville, IL 60563-8895

Phone: (708) 505-9100 x256
EMail: stevea@isc.com

bestie, that's the whole chair situation 💅🎀

📦 where this page comes from

ietf: rfc1416 1993-02
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms