RFC 1731

IMAP4 Authentication Mechanisms

📅 published December 1994, from ietf

IMAP4 Authentication Mechanisms 🎀

Okay bestie, the title block is the tea ☕ This is RFC 1731, from the Network Working Group, written by J. Myers of Carnegie Mellon, filed under Standards Track, dated December 1994. The title block doesn't list anything it obsoletes or updates.

Status of this Memo ✨

This doc is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🗣️ For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈

1. Introduction 💖

The Internet Message Access Protocol, Version 4 [IMAP4] has the AUTHENTICATE command. It's for identifying and authenticating a user to an IMAP4 server, and for optionally negotiating a protection mechanism for later protocol interactions. This doc describes several authentication mechanisms that the IMAP4 AUTHENTICATE command can use 🧚

2. Kerberos version 4 authentication mechanism 🦋

The authentication type for Kerberos version 4 is "KERBEROS_V4". ✨

The data in the first ready response is a random 32-bit number, sent in network byte order. The client SHOULD answer with a Kerberos ticket and an authenticator for the principal "imap.hostname@realm", where hostname is the first component of the server's host name with all letters in lower case, and realm is the Kerberos realm of the server. The encrypted checksum field inside the Kerberos authenticator SHOULD hold the server-provided 32-bit number in network byte order 💅

After decrypting and verifying the ticket and authenticator, the server SHOULD verify that the checksum field inside equals the original server-provided random 32-bit number. If that check passes, the server MUST add one to the checksum and build 8 octets of data:

The first four octets hold the incremented checksum, in network byte order.
The fifth octet holds a bit-mask specifying the protection mechanisms the server supports.
The sixth through eighth octets hold, in network byte order, the maximum cipher-text buffer size the server is able to receive.

The server MUST encrypt those 8 octets in the session key and send the encrypted data in a second ready response. The client SHOULD consider the server authenticated if the first four octets of the un-encrypted data equal one plus the checksum it previously sent 🫶

The client MUST construct its data like this:

The first four octets hold the original server-issued checksum, in network byte order.
The fifth octet holds the bit-mask for the selected protection mechanism.
The sixth through eighth octets hold, in network byte order, the maximum cipher-text buffer size the client is able to receive.
The octets after that hold a user name string.

The client MUST then append anywhere from one to eight octets so the length of the data is a multiple of eight octets. The client MUST then PCBC encrypt the data with the session key and respond to the second ready response with the encrypted data. The server decrypts the data and verifies the contained checksum. The username field identifies the user for whom subsequent IMAP operations are to be performed, so the server MUST verify that the principal identified in the Kerberos ticket is authorized to connect as that user. Once those verifications are done, the authentication process is complete 🎉

The protection mechanisms and their corresponding bit-masks are as follows:

      1 No protection mechanism
      2 Integrity (krb_mk_safe) protection
      4 Privacy (krb_mk_priv) protection

EXAMPLE: Here are two Kerberos version 4 login scenarios. Heads up that the line breaks in the sample authenticators are just for editorial clarity and aren't in real authenticators 🙈

      S: * OK IMAP4 Server
      C: A001 AUTHENTICATE KERBEROS_V4
      S: + AmFYig==
      C: BAcAQU5EUkVXLkNNVS5FRFUAOCAsho84kLN3/IJmrMG+25a4DT
         +nZImJjnTNHJUtxAA+o0KPKfHEcAFs9a3CL5Oebe/ydHJUwYFd
         WwuQ1MWiy6IesKvjL5rL9WjXUb9MwT9bpObYLGOKi1Qh
      S: + or//EoAADZI=
      C: DiAF5A4gA+oOIALuBkAAmw==
      S: A001 OK Kerberos V4 authentication successful
      S: * OK IMAP4 Server
      C: A001 AUTHENTICATE KERBEROS_V4
      S: + gcfgCA==
      C: BAcAQU5EUkVXLkNNVS5FRFUAOCAsho84kLN3/IJmrMG+25a4DT
         +nZImJjnTNHJUtxAA+o0KPKfHEcAFs9a3CL5Oebe/ydHJUwYFd
         WwuQ1MWiy6IesKvjL5rL9WjXUb9MwT9bpObYLGOKi1Qh
      S: A001 NO Kerberos V4 authentication failed

3. GSSAPI authentication mechanism 🌸

The authentication type for all mechanisms using the GSSAPI [RFC1508] is "GSSAPI". 💜

The first ready response from the server has no data in it. The client SHOULD call GSS_Init_sec_context, passing in 0 for input_context_handle (initially) and a targ_name equal to the output_name from GSS_Import_Name, which is called with input_name_type of NULL and input_name_string of "SERVICE:imap@hostname". Here hostname is the fully qualified host name of the server with all letters in lower case. The client MUST then respond with the resulting output_token. If GSS_Init_sec_context returns GSS_CONTINUE_NEEDED, the client SHOULD expect the server to issue a token in a later ready response. The client MUST pass that token to another call to GSS_Init_sec_context ✨

If GSS_Init_sec_context returns GSS_COMPLETE, the client SHOULD respond with any resulting output_token. If there is no output_token, the client SHOULD respond with no data. The client SHOULD then expect the server to issue a token in a later ready response. The client SHOULD pass this token to GSS_Unseal and interpret the first octet of the resulting cleartext as a bit-mask specifying the protection mechanisms the server supports, and the second through fourth octets as the maximum size output_message to send to the server. The client SHOULD construct its data: the first octet holds the bit-mask for the selected protection mechanism, the second through fourth octets hold, in network byte order, the maximum size output_message the client is able to receive, and the remaining octets hold a user name string. The client MUST pass the data to GSS_Seal with conf_flag set to FALSE, and respond with the generated output_message. The client can then consider the server authenticated 🔥

The server MUST issue a ready response with no data, and pass the resulting client supplied token to GSS_Accept_sec_context as input_token, setting acceptor_cred_handle to NULL (for "use default credentials") and 0 for input_context_handle (initially). If GSS_Accept_sec_context returns GSS_CONTINUE_NEEDED, the server SHOULD return the generated output_token to the client in a ready response, and pass the resulting client supplied token to another call to GSS_Accept_sec_context 🦋

If GSS_Accept_sec_context returns GSS_COMPLETE, then, if an output_token is returned, the server SHOULD return it to the client in a ready response and expect a reply from the client with no data. Whether or not an output_token was returned, the server SHOULD then construct 4 octets of data. The first octet holds a bit-mask specifying the protection mechanisms the server supports, and the second through fourth octets hold, in network byte order, the maximum size output_token the server is able to receive. The server MUST then pass the plaintext to GSS_Seal with conf_flag set to FALSE, and issue the generated output_message to the client in a ready response. The server MUST then pass the resulting client supplied token to GSS_Unseal and interpret the first octet of the resulting cleartext as the bit-mask for the selected protection mechanism, the second through fourth octets as the maximum size output_message to send to the client, and the remaining octets as the user name. Once the server has verified that src_name is authorized to authenticate as the user name, the server SHOULD then consider the client authenticated 👑

The protection mechanisms and their corresponding bit-masks are as follows:

      1 No protection mechanism
      2 Integrity protection.
        Sender calls GSS_Seal with conf_flag set to FALSE
      4 Privacy protection.
        Sender calls GSS_Seal with conf_flag set to TRUE

4. S/Key authentication mechanism 🍓

The authentication type for S/Key [SKEY] is "SKEY". 🌈

The first ready response from the server has no data in it. The client responds with the user name string.

The data in the second ready response is the decimal sequence number, followed by a single space and the seed string for the indicated user. The client responds with the one-time-password, either as a 64-bit value in network byte order or encoded in the "six English words" format 🫧

Once the one-time-password checks out, the server SHOULD consider the client authenticated ✨

S/Key authentication does not provide for any protection mechanisms. 🙃

EXAMPLE: Two S/Key login scenarios, coming right up 🧚

      S: * OK IMAP4 Server
      C: A001 AUTHENTICATE SKEY
      S: +
      C: bW9yZ2Fu
      S: + OTUgUWE1ODMwOA==
      C: Rk9VUiBNQU5OIFNPT04gRklSIFZBUlkgTUFTSA==
      S: A001 OK S/Key authentication successful


      S: * OK IMAP4 Server
      C: A001 AUTHENTICATE SKEY
      S: +
      C: c21pdGg=
      S: + OTUgUWE1ODMwOA==
      C: BsAY3g4gBNo=
      S: A001 NO S/Key authentication failed

5. References 📚

[IMAP4] Crispin, M., "Internet Message Access Protocol - Version 4", RFC 1730, University of Washington, December 1994.
[RFC1508] Linn, J., "Generic Security Service Application Program Interface", RFC 1508, Geer Zolot Associates, September 1993.
[SKEY] Haller, Neil M. "The S/Key One-Time Password System", Bellcore, Morristown, New Jersey, October 1993, thumper.bellcore.com:pub/nmh/docs/ISOC.symp.ps

6. Security Considerations 🔒

Okay, this section is short but SUPER important, so pay attention 😭

Security issues are discussed throughout this memo. 💀

7. Author's Address 🫶

John G. Myers, Carnegie-Mellon University, 5000 Forbes Ave., Pittsburgh PA, 15213-3890

EMail: jgm+@cmu.edu

📦 where this page comes from

ietf: rfc1731 1994-12
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms