Full Copyright Statement . . . . . . . . . . . . . . This protocol is extremely insecure, as it transmits the user name, current and new passwords in clear text. It also has more round-trips than needed, and lacks an extension mechanism. The protocol also traditionally usurps port 106, which is actually assigned for a different purpose. This document proposes a replacement protocol for password changing which is easy to implement on both client and server, and avoids the above problems.
Any line wrapping is done for editorial clarity only.
Commands and responses may be sent in any case. Use of upper case is for editorial clarity only. Private comments should be sent to the author. In response to a client opening a connection, the server sends a greeting which lists the supported capabilities, including privacy mechanisms. The client initiates a security layer.