RFC 1734

POP3 AUTHentication command

📅 published December 1994, from ietf

RFC 1734: POP3 AUTHentication command 🎀

okay bestie, this one is all about giving POP3 proper login options, and it's giving "why reinvent the wheel when IMAP already did the work" energy 💅✨

Request for Comments: 1734 🌸
Title: POP3 AUTHentication command 💖
Author: J. Myers, of Carnegie Mellon (written out as John G. Myers in the address section) 🧚
Category: Standards Track 📜
Date: December 1994 🦋
Obsoletes and updates: nothing listed in the header 🙈

Status of This Memo 📜

ngl this part is the boring legal-ish bit, but it matters 🥹 This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.

1. Introduction ✨

okay so this doc describes the optional AUTH command 🎀 It lets a client tell the server which authentication mechanism it wants, run the authentication exchange, and optionally agree on a protection mechanism for everything that comes after. The authentication and protection mechanisms POP3 uses here are the same ones IMAP4 uses. Reuse is the whole main character energy of this RFC 💅

2. The AUTH command 🔥

Arguments:

a string naming an IMAP4 authentication mechanism, like the ones defined in [IMAP4-AUTH]. Any use of the string "imap" inside a server authentication identity, within the definition of an authentication mechanism, gets swapped out for the string "pop" 🦋

Restrictions:

it may only be given in the AUTHORIZATION state 🔒

Discussion:

okay so the AUTH command tells the server which authentication mechanism you're using. If the server supports that mechanism, it runs an authentication protocol exchange to authenticate and identify the user. It can also optionally negotiate a protection mechanism for the interactions that follow. If the requested mechanism isn't supported, the server should reject the AUTH command by sending a negative response 🙅‍♀️

The authentication exchange is a back-and-forth of server challenges and client answers that depend on the mechanism. A server challenge, also called a ready response, is a line made of a "+" character, a single space, and a BASE64 encoded string. The client answer is a line containing a BASE64 encoded string. If the client wants to cancel the exchange, it should send a line with just a single "*". If the server gets that answer, it must reject the AUTH command by sending a negative response 🛑

Now the protection mechanism, which is where it gets spicy 🌶️ It gives integrity and privacy protection to the session, and once it's negotiated, it's applied to all the data sent over the connection after that. It kicks in immediately after the CRLF that ends the authentication exchange for the client, and after the CRLF of the positive response for the server. From then on, the stream of command and response octets gets processed into buffers of ciphertext. Each buffer goes over the connection as a stream of octets with a four octet field in network byte order in front of it, and that field gives the length of the data that follows. The maximum ciphertext buffer length is defined by the protection mechanism 🔐

Here's the thing: the server isn't required to support any particular authentication mechanism, and authentication mechanisms aren't required to support any protection mechanisms either 🙃 If an AUTH command fails with a negative response, the session stays in the AUTHORIZATION state. The client can then try a different mechanism with another AUTH command, or authenticate using the USER/PASS or APOP commands. So basically, the client can request authentication types in decreasing order of preference, with USER/PASS or APOP as the last resort 🪜

And if the client finishes the authentication exchange successfully, the POP3 server sends a positive response and the session enters the TRANSACTION state 🎉

Possible Responses:

+OK maildrop locked and ready
-ERR authentication exchange failed

Examples:

S: +OK POP3 server ready
C: AUTH KERBEROS_V4
S: + AmFYig==
C: BAcAQU5EUkVXLkNNVS5FRFUAOCAsho84kLN3/IJmrMG+25a4DT
   +nZImJjnTNHJUtxAA+o0KPKfHEcAFs9a3CL5Oebe/ydHJUwYFd
   WwuQ1MWiy6IesKvjL5rL9WjXUb9MwT9bpObYLGOKi1Qh
S: + or//EoAADZI=
C: DiAF5A4gA+oOIALuBkAAmw==
S: +OK Kerberos V4 authentication successful
   ...
C: AUTH FOOBAR
S: -ERR Unrecognized authentication type

Note: the line breaks in the first client answer are for editorial clarity and are not in real authentica-tors 🙈

3. Formal Syntax 🧩

The following syntax specification uses the augmented Backus-Naur Form (BNF) notation as specified in RFC 822 📝

Except as noted otherwise, all alphabetic characters are case-insensitive. The use of upper or lower case characters to define token strings is for editorial clarity only. This part is a big deal: Implementations MUST accept these strings in a case-insensitive fashion 💅

ATOM_CHAR       ::= <any CHAR except atom_specials>

atom_specials   ::= "(" / ")" / "{" / SPACE / CTLs / "%" / "*" /
                    <"> / "\"

auth            ::= "AUTH" 1*(SPACE / TAB) auth_type *(CRLF base64)
                    CRLF

auth_type       ::= 1*ATOM_CHAR

base64          ::= *(4base64_CHAR) [base64_terminal]

base64_char     ::= "A" / "B" / "C" / "D" / "E" / "F" / "G" / "H" /
        "I" / "J" / "K" / "L" / "M" / "N" / "O" / "P" /
                    "Q" / "R" / "S" / "T" / "U" / "V" / "W" / "X" /
                    "Y" / "Z" /
                    "a" / "b" / "c" / "d" / "e" / "f" / "g" / "h" /
                    "i" / "j" / "k" / "l" / "m" / "n" / "o" / "p" /
                    "q" / "r" / "s" / "t" / "u" / "v" / "w" / "x" /
                    "y" / "z" /
                    "0" / "1" / "2" / "3" / "4" / "5" / "6" / "7" /
                    "8" / "9" / "+" / "/"
                    ;; Case-sensitive

base64_terminal ::= (2base64_char "==") / (3base64_char "=")

CHAR            ::= <any 7-bit US-ASCII character except NUL,
                     0x01 - 0x7f>

continue_req    ::= "+" SPACE base64 CRLF

CR              ::= <ASCII CR, carriage return, 0x0C>

CRLF            ::= CR LF

CTL             ::= <any ASCII control character and DEL,
                     0x00 - 0x1f, 0x7f>

LF              ::= <ASCII LF, line feed, 0x0A>

SPACE           ::= <ASCII SP, space, 0x20>

TAB             ::= <ASCII HT, tab, 0x09>

4. References 📚

[IMAP4-AUTH] Myers, J., "IMAP4 Authentication Mechanisms", RFC 1731, Carnegie Mellon, December 1994. 🔖

5. Security Considerations 🚨

Security issues are discussed throughout this memo. Bestie, I mean it: security is woven through the entire thing, so don't skip the vibes 💀

6. Author's Address 🏫

John G. Myers Carnegie-Mellon University 5000 Forbes Ave Pittsburgh, PA 15213

EMail: jgm+@cmu.edu 💌

📦 where this page comes from

ietf: rfc1734 1994-12
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms