Authentication Mechanisms
=========================

Authentication mechanism means the protocol that an IMAP or POP3 client uses to
communicate with Dovecot to perform the authentication. The most simple one is
PLAIN mechanism, in which the client simply sends the password unencrypted to
Dovecot. All clients support the PLAIN mechanism, but obviously there's the
problem that anyone listening the network can steal the password. For that
reason (and some others) other mechanisms were implemented.

Non-PLAIN mechanisms have one major disadvantage however. In server side the
password must be stored in a special format or in plaintext. This makes it
impossible to use most mechanisms with commonly used DES and MD5 crypted
passwords.

Today however many people use SSL, and there's no problem with sending
unencrypted password inside SSL secured connections. So if you're using SSL,
you probably don't need to bother worrying about anything else than the PLAIN
mechanism.

Other non-PLAIN mechanisms include:

 * CRAM-MD5: Protects the password in transit against eavesdroppers. Somewhat
   good support in clients.
 * DIGEST-MD5: Somewhat stronger cryptographically than CRAM-MD5, but clients
   rarely support it.
 * APOP: This is a POP3-specific authentication. Similiar to CRAM-MD5, but
   requires storing password in plaintext.
 * NTLM: Mechanism created by Microsoft and supported by their clients.
 * GSSAPI: Kerberos v5 support.
 * RPA: Compuserve RPA authentication mechanism. Similar to DIGEST-MD5, but
   client support is rare.
 * LOGIN: Similiar to PLAIN, useful only when serving SMTP AUTH to Outlook
   clients (ie. pretty useless with IMAP and POP3).
 * ANONYMOUS: Support for logging in anonymously. This may be useful if you're
   intending to provide publically accessible IMAP archive.
 * OTP and SKEY: One time password mechanisms. Supported only by Dovecot v1.1
   and later.

(This file was created from the wiki on 2007-04-13 14:32)
