It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. All Rights Reserved. The server does not authenticate itself to the user. Upon agreeing to support this option, the parties are then able to perform sub-option negotiations to determine the authentication protocol to be used, and possibly the remote user name to be used for authorization checking.
Encryption is negotiated along with the type of the authentication.
Authentication and parameter negotiation occur within an unbounded series of exchanges. In addition to listing the mechanisms it supports, the server qualifies each mechanism with a modifier that specifies whether encryption of data is desired. The client selects one mechanism from the list and responds to the server indicating its choice and the first set of authentication data needed for the selected authentication type. The client may ignore a request to encrypt data and so indicate, but the server may also terminate the connection if the client refuses encryption. The server and the client then proceed through whatever number of iterations is required to arrive at the requested authentication.