imself as the user at will (at least
   until detected).

   Failure to implement server requirement 3 in section 4.3 opens an
   implementation to an attack based on replay of the current-OTP part
   of the response.

6. Acknowledgments

   Like <A HREF="rfc1938.html">RFC 1938</A>, the protocol described in this document was created by
   contributors in the IETF OTP working group. Specific contributions
   were made by Neil Haller, who provided input on the overall design
   requirements of a re-initializ