t active attacks. The IPsec Authentication Header (<A HREF="rfc1826.html">RFC-1826</A>)
   (or another technique with at least as much strength as IPsec AH)
   SHOULD be used to protect against such attacks.

   The consequences of a successful active attack on the re-
   initialization response may be more severe than simply hijacking a
   single session. An attacker could substitute his own response for

   that of a legitimate user. The attacker may then be able to use the
   OTP system to authenticate h