M Taylor wrote:
>
> Now I would be interested to see if a secure (cryptographic) authenication
> method would be acceptable - no data is encrypted just a secure
> "handshake" to validate a remote operator's identity, perhaps using
> public key digital signatures.
>
You could use OPIE for this. See bolow for some quotes from the README.
"One-time Passwords In Everything" (OPIE) is a freely distributable
software package originally developed at and for the US Naval Research
Laboratory (NRL). Recent versions are the result of a cooperative effort
between of NRL, several of the original NRL authors, The Inner Net, and
many
other contributors from the Internet community.
OPIE is an implementation of the One-Time Password (OTP) System that
is being considered for the Internet standards-track. OPIE provides a
one-time
password system. The system should be secure against the passive attacks
now commonplace on the Internet (see RFC 1704 for more details). The
system
is vulnerable to active dictionary attacks, though these are not
widespread
at present and can be detected through proper use of system audit
software.
The latest version is available by anonymous FTP at:
ftp://ftp.nrl.navy.mil/pub/security/opie
and
ftp://ftp.inner.net/pub/opie
This afternoon I couldn't get a response from both of these servers but
I have a copy and could place it on a ftp site.
73, Arno pe1icq
