anchor.diff:  (defvar *des-public-keys* nil
     "List of public keys for each client that may talk to the server.")
   
  -(defstruct des-key
  -  fullname key)
  +(defstruct des-key fullname key)
   
   (defun add-des-public-key (fullname key)
     (push (make-des-key :fullname fullname
  
positive.code: ;; the verifier sent by the client
  (defxstruct authdes-verf-client ()
    (adv-timestamp (:varray* :octet)) ;; encrypted timestamp
    (adv-winverf (:array :octet 4))) ;; encrypted window
  
  ;; the verifier sent by the server 
  (defxstruct authdes-verf-server ()
    (adv-timeverf (:varray* :octet)) ;; encrypted timestamp -1 
    (adv-nickname :int32)) ;; nickname to be used for the conversation
  
  (defun make-auth-des-client-verifier (timestamp window)
    (let ((v (nibbles:make-octet-vector 16)))
      ;; pack the structure
      (setf (nibbles:ub32ref/be v 0) (getf timestamp :seconds)
  	  (nibbles:ub32ref/be v 4) (getf timestamp :useconds)
  	  (nibbles:ub32ref/be v 8) window
  	  (nibbles:ub32ref/be v 12) (1- timestamp))
      ;; FIXME: encrypt v
      (make-authdes-verf-client :adv-timestamp (subseq v 0 8)
  			      :adv-winverf (subseq v 12 16))))
  
  ;; Diffie-Hellman encryption
  
  
negative.code: 
  
  ;; 9.3 DES authentication
  ;; Procress is as follows:
  ;; 1. Client sends an authdes-cred (fullname) structure to the server. This contains the conversion key
  ;; and a time window, both encrypted in the server's public key. The window is the amount of time the 
  ;; credential should be valid for. 
  ;; In this initial request, the client ALSO sends a verifier which contains the current timestamp,
  ;; the same window as in the authenticator, and the current timestamp -1. This structure is encrypted 
  ;; in DES CBC mode using the conversation key and null IV.
  ;; 2. The server decrypts the authenticator to extract the conversation key. This is then used 
  ;; to decrypt the verifier. The server validates that the timestamp, window and timestamp-1 are 
  ;; all consistent. It then assigns this client a nickname (a random number) and returns the same timestamp-1
  ;; (encrypted) and the nickname. 
  ;; 3. The client validates that the verifier the server responded with is valid by decrypting and checking the 
  ;; timestamp.
  ;; 4. All subsequent client requests now send an authenticator consisting just of the nickname. The 
  ;; verifier should now be the encryted timestamp and encrypted window verifier.
  
  
  
  (defxenum authdes-namekind 
    (:adn-fullname 0)
  