[PATCH] lisp/server.el: Introduction of server-auth-key variable

[PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

From: Michal Nazarewicz <mina86@mina86.com>

This commit adds a server-auth-key variable which allows
user to specify a default authentication key used by the
server process.
---
 lisp/server.el |   42 +++++++++++++++++++++++++++++++++++-------
 1 files changed, 35 insertions(+), 7 deletions(-)

Hello, attached is a patch that adds a `server-auth-key' variable,
which I use to easily allow a host to connect to Emacs daemon
listening on TCP port without the need of synchronising the server
file each time server starts.

The etc/CONTRIBUTE mentions ChangeLog entry.  I'm unsure whether
you need anything more then the commit message above but in case
you do, here's ChangeLog entry:

2011-02-21  Michal Nazarewicz  <mina86@mina86.com>  (tiny change)

	* lisp/server.el: Introduce server-auth-key variable which
	allows user to specify a default authentication key used by
	the server process.

Hope you guys don't mind git style patch mail.

diff --git a/lisp/server.el b/lisp/server.el
index df8cae0..3963e86 100644
--- a/lisp/server.el
+++ b/lisp/server.el
@@ -134,6 +134,27 @@ directory residing in a NTFS partition instead."
 ;;;###autoload
 (put 'server-auth-dir 'risky-local-variable t)
 
+(defcustom server-auth-key nil
+  "Server authentication key.
+
+Normally, authentication key is generated on random when server
+starts, which guarantees a certain level of security.  It is
+recommended to leave it that way.
+
+In some situations however, it can be difficult to share randomly
+generated password with remote hosts (eg. no shared directory),
+so you can set the key with this variable and then copy server
+file to remote host (with possible changes to IP address and/or
+port if that applies).
+
+You can use \\[server-generate-key] to get a random authentication
+key."
+  :group 'server
+  :type '(choice
+	  (const :tag "Random" nil)
+	  (string :tag "Password"))
+  :version "24.0")
+
 (defcustom server-raise-frame t
   "If non-nil, raise frame when switching to a buffer."
   :group 'server
@@ -495,6 +516,19 @@ See variable `server-auth-dir' for details."
       (unless safe
 	(error "The directory `%s' is unsafe" dir)))))
 
+(defun server-generate-key ()
+  "Generates and returns a random 64-byte strings of random chars
+in the range `!'..`~'. If called interactively, also inserts it
+into current buffer."
+  (interactive)
+  (let ((auth-key
+	 (loop repeat 64
+	       collect (+ 33 (random 94)) into auth
+	       finally return (concat auth))))
+    (if (called-interactively-p)
+	(insert auth-key))
+    auth-key))
+
 ;;;###autoload
 (defun server-start (&optional leave-dead inhibit-prompt)
   "Allow this Emacs process to be a server for client processes.
@@ -588,13 +622,7 @@ server or call `M-x server-force-delete' to forcibly disconnect it.")
 	  (unless server-process (error "Could not start server process"))
 	  (process-put server-process :server-file server-file)
 	  (when server-use-tcp
-	    (let ((auth-key
-		   (loop
-		      ;; The auth key is a 64-byte string of random chars in the
-		      ;; range `!'..`~'.
-		      repeat 64
-		      collect (+ 33 (random 94)) into auth
-		      finally return (concat auth))))
+	    (let ((auth-key (or server-auth-key (server-generate-key))))
 	      (process-put server-process :auth-key auth-key)
 	      (with-temp-file server-file
 		(set-buffer-multibyte nil)
-- 
1.7.3.1

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Juanma Barranquero]

On Tue, Feb 22, 2011 at 14:55, Michal Nazarewicz <mnazarewicz@google.com> wrote:
> From: Michal Nazarewicz <mina86@mina86.com>
>
> This commit adds a server-auth-key variable which allows
> user to specify a default authentication key used by the
> server process.

Do we want to add this to server.el, or dismiss it?

If we want to commit it, it is certainly not "tiny" and papers would
have to be signed before.

    Juanma

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

> On Tue, Feb 22, 2011 at 14:55, Michal Nazarewicz wrote:
>> This commit adds a server-auth-key variable which allows
>> user to specify a default authentication key used by the
>> server process.

On Fri, 29 Apr 2011 13:30:45 +0200, Juanma Barranquero wrote:
> Do we want to add this to server.el, or dismiss it?
>
> If we want to commit it, it is certainly not "tiny" and papers
> would have to be signed before.

The patch seemed rather straightforward but if you guys decide to
include it and papers need to be signed just let me know as it
should not be a problem.

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
ooo +-----<email/xmpp: mnazarewicz@google.com>-----ooO--(_)--Ooo--

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Juanma Barranquero]

2011/4/29 Michal Nazarewicz <mina86@mina86.com>:

> The patch seemed rather straightforward but if you guys decide to
> include it and papers need to be signed just let me know as it
> should not be a problem.

As soon as the contributions amount to more than 10-15 lines of
non-trivial code, papers must be signed.

    Juanma

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

> 2011/4/29 Michal Nazarewicz wrote:
>> The patch seemed rather straightforward but if you guys decide to
>> include it and papers need to be signed just let me know as it
>> should not be a problem.

On Fri, 29 Apr 2011 14:02:10 +0200, Juanma Barranquero wrote:
> As soon as the contributions amount to more than 10-15 lines of
> non-trivial code, papers must be signed.

The patch was just a bit of documentation, a piece of code moved
to a separate function and a single (or ...) added hence I considered
it trivial.

At any rate, copyright assignment should not be a problem, but since
Google holds the copyright for the patch I need to contact legal.

Could you just point me to the forms?

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
ooo +-----<email/xmpp: mnazarewicz@google.com>-----ooO--(_)--Ooo--

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

On Fri, 29 Apr 2011 14:02:10 +0200, Juanma Barranquero wrote:
> As soon as the contributions amount to more than 10-15 lines of
> non-trivial code, papers must be signed.

I just got a piece of information that Google already has
a copyright assignment on file with the FSF.

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
ooo +-----<email/xmpp: mnazarewicz@google.com>-----ooO--(_)--Ooo--

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Stefan Monnier]

> +In some situations however, it can be difficult to share randomly
> +generated password with remote hosts (eg. no shared directory),

ssh/scp work fine for me.

> +so you can set the key with this variable and then copy server
> +file to remote host (with possible changes to IP address and/or
> +port if that applies).

IIUC this only makes sense if you want to use a shared key that you keep
for a "long" time (since the intention is to reduce the frequency of
key-distribution).
Now the server keys are sent in the clear over the network, so the
security we provide is rather minimal.  OT1H that means your patch
should be OK since we don't really have security anyway.  OTOH it means
that it makes the security threat more serious.


        Stefan


PS: emacsclient should really try not to send the key in cleartext, but
instead send something like "nonce,hash(nonce,key)".

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

On Fri, 29 Apr 2011 18:22:27 +0200, Stefan Monnier  
<monnier@iro.umontreal.ca> wrote:

>> +In some situations however, it can be difficult to share randomly
>> +generated password with remote hosts (eg. no shared directory),
>
> ssh/scp work fine for me.

Yes, but you'd have to send the key every time you connect to the remote
host and every time you restart emacs.  I thought about something like
that but decided that it'd be easier to just use a single shared key.

>> +so you can set the key with this variable and then copy server
>> +file to remote host (with possible changes to IP address and/or
>> +port if that applies).
>
> IIUC this only makes sense if you want to use a shared key that you keep
> for a "long" time (since the intention is to reduce the frequency of
> key-distribution).

Yep, that's my use-case.

> Now the server keys are sent in the clear over the network, so the
> security we provide is rather minimal.

In my case it's not actually an issue since I use OpenVPN to connect
to my remote host, not to say that in general this may decrease
security for some users should they choose to use it.

> OT1H that means your patch should be OK since we don't really have
> security anyway.  OTOH it means that it makes the security threat
> more serious.

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
ooo +-----<email/xmpp: mnazarewicz@google.com>-----ooO--(_)--Ooo--

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Stefan Monnier]

> Yes, but you'd have to send the key every time you connect to the remote
> host and every time you restart emacs.

I used something like "scp <server>:<authfile> .; emacsclient" last time
I needed such a thing, which is a bit slowish, indeed.

>> IIUC this only makes sense if you want to use a shared key that you keep
>> for a "long" time (since the intention is to reduce the frequency of
>> key-distribution).
> Yep, that's my use-case.

I guess it could make sense.  I'd rather like to see such a feature
provided some other way (e.g. share the key via ssh-agent, or rely on
GNUtls for authentication), but I guess in the mean time it might be OK,
provided the docstring strongly encourages users not to use it and to
expect it to disappear in the future.


        Stefan

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Eli Zaretskii]

> Date: Fri, 29 Apr 2011 16:34:18 +0200
> From: "Michal Nazarewicz" <mina86@mina86.com>
> Cc: emacs-devel@gnu.org
> 
> I just got a piece of information that Google already has
> a copyright assignment on file with the FSF.

That's true, but I don't know what that means for each employee of
Google who wants to contribute to Emacs.  Richard, could you please
clarify?  I see this in copyright.list:

  ANY	Google Inc.	2007-03-15
  Assigns Changes
  Bill Coughran
  Vice President
  Engineering

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Juanma Barranquero]

On Fri, Apr 29, 2011 at 18:22, Stefan Monnier <monnier@iro.umontreal.ca> wrote:

> PS: emacsclient should really try not to send the key in cleartext, but
> instead send something like "nonce,hash(nonce,key)".

That's not hard to do, assuming that md5 is an acceptable hash
(because we already include C and elisp implementation, unlike
SHA-xx).

In the server side,

  (unless (process-get proc :authenticated)
    (if (or
         ;; New method: -auth2 nonce md5(nonce . auth-key)
         (and (string-match "-auth2 \\([!-~]+\\)
\\([0-9a-f]\\{32\\}\\)\n?" string)
              (string= (md5 (concat (match-string 1 string)
                                    (process-get proc :auth-key)))
                       (match-string 2 string)))
         ;; Old method: -auth auth-key
         (and (string-match "-auth \\([!-~]+\\)\n?" string)
              (string= (match-string 1 string) (process-get proc :auth-key))))
	(...set authenticated)
      (...fail))

but in the emacsclient side, if it sends -auth2 it won't be
back-compatible with pre-24.1, and if it tries -auth, then -auth2,
-auth2 is not really used beause -auth is always accepted. So the only
ways I see to make this useful at all is to remove compatibility, or
introduce some kind of version check, perhaps resurrecting the
currently obsolete -version command:

                ;; -version CLIENT-VERSION: obsolete at birth.
                (`"-version" (pop args-left))

    Juanma

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Richard Stallman]

    That's true, but I don't know what that means for each employee of
    Google who wants to contribute to Emacs.  Richard, could you please
    clarify?

Please ask assign@gnu.org questions like this.  It is his job.

I do not have a copy of that contract with me here.

-- 
Dr Richard Stallman
President, Free Software Foundation
51 Franklin St
Boston MA 02110
USA
www.fsf.org, www.gnu.org
Skype: No way! That's nonfree (freedom-denying) software.
  Use free telephony http://directory.fsf.org/category/tel/

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

[-- Attachment #1: Type: text/plain, Size: 987 bytes --]

>> Date: Fri, 29 Apr 2011 16:34:18 +0200
>> From: "Michal Nazarewicz" <mina86@mina86.com>
>> Cc: emacs-devel@gnu.org
>> 
>> I just got a piece of information that Google already has
>> a copyright assignment on file with the FSF.

Eli Zaretskii <eliz@gnu.org> writes:
> That's true, but I don't know what that means for each employee of
> Google who wants to contribute to Emacs.  Richard, could you please
> clarify?  I see this in copyright.list:
>
>   ANY	Google Inc.	2007-03-15
>   Assigns Changes
>   Bill Coughran
>   Vice President
>   Engineering

Google has the copyright on this one, I'm "just" an author, so I'd
assume mine contributions work the same way as any other Google
employee.

-- 
Best regards,                                          _     _
 .o. | Liege of Serenly Enlightened Majesty of       o' \,=./ `o
 ..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
 ooo +-<mina86-mina86.com>-<jid:mina86-jabber.org>--ooO--(_)--Ooo--

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

[-- Attachment #1: Type: text/plain, Size: 2507 bytes --]

Juanma Barranquero <lekktu@gmail.com> writes:

> On Fri, Apr 29, 2011 at 18:22, Stefan Monnier <monnier@iro.umontreal.ca> wrote:
>
>> PS: emacsclient should really try not to send the key in cleartext, but
>> instead send something like "nonce,hash(nonce,key)".
>
> That's not hard to do, assuming that md5 is an acceptable hash
> (because we already include C and elisp implementation, unlike
> SHA-xx).

Depending on how paranoid are we, MD5 could feel too weak though.
(Also, one could wish for HMAC.)

> In the server side,
>
>   (unless (process-get proc :authenticated)
>     (if (or
>          ;; New method: -auth2 nonce md5(nonce . auth-key)
>          (and (string-match "-auth2 \\([!-~]+\\)
> \\([0-9a-f]\\{32\\}\\)\n?" string)
>               (string= (md5 (concat (match-string 1 string)
>                                     (process-get proc :auth-key)))
>                        (match-string 2 string)))
>          ;; Old method: -auth auth-key
>          (and (string-match "-auth \\([!-~]+\\)\n?" string)
>               (string= (match-string 1 string) (process-get proc :auth-key))))
> 	(...set authenticated)
>       (...fail))

Actually, server would have to generate the nonce.  Otherwise, the
authentication scheme would be prone to replay attacks and would really
defy the purpose of nonce.

> but in the emacsclient side, if it sends -auth2 it won't be
> back-compatible with pre-24.1, and if it tries -auth, then -auth2,
> -auth2 is not really used beause -auth is always accepted. So the only
> ways I see to make this useful at all is to remove compatibility, or
> introduce some kind of version check, perhaps resurrecting the
> currently obsolete -version command:
>
>                 ;; -version CLIENT-VERSION: obsolete at birth.
>                 (`"-version" (pop args-left))

That would still break backward compatibility, wouldn't it?  The old
servers would not accept this command anyway.  Unless server would issue
it to client just after making connection.  From what I see, the old
clients would "only" print error message.

In the worst case, the client could first try the new authenticating
scheme and on error reconnect with the old scheme.

-- 
Best regards,                                          _     _
 .o. | Liege of Serenly Enlightened Majesty of       o' \,=./ `o
 ..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
 ooo +-<mina86-mina86.com>-<jid:mina86-jabber.org>--ooO--(_)--Ooo--

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Juanma Barranquero]

2011/5/1 Michal Nazarewicz <mina86@mina86.com>:

> Depending on how paranoid are we, MD5 could feel too weak though.
> (Also, one could wish for HMAC.)

I am not feeling particularly paranoid just now, seeing as we've been
using a cleartext authentication key for the past few years...

> Actually, server would have to generate the nonce.  Otherwise, the
> authentication scheme would be prone to replay attacks and would really
> defy the purpose of nonce.

OK, I in fact prefer to generate the nonce in elisp.

> That would still break backward compatibility, wouldn't it?  The old
> servers would not accept this command anyway.  Unless server would issue
> it to client just after making connection.  From what I see, the old
> clients would "only" print error message.

Yeah, but a failed -auth closes the connection and deletes the
process, while an unknown command just issues an error message. One
way or another, I don't think we can avoid the error message on the
emacsclient side.

> In the worst case, the client could first try the new authenticating
> scheme and on error reconnect with the old scheme.

Yes, but as the connection is closed, that adds a bit of complexity to
emacsclient that I'd like to avoid if possible.

    Juanma

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

[-- Attachment #1: Type: text/plain, Size: 1873 bytes --]

Juanma Barranquero <lekktu@gmail.com> writes:

> 2011/5/1 Michal Nazarewicz <mina86@mina86.com>:
>
>> Depending on how paranoid are we, MD5 could feel too weak though.
>> (Also, one could wish for HMAC.)
>
> I am not feeling particularly paranoid just now, seeing as we've been
> using a cleartext authentication key for the past few years...

Yep, that was my impression. ;)

>> Actually, server would have to generate the nonce.  Otherwise, the
>> authentication scheme would be prone to replay attacks and would really
>> defy the purpose of nonce.
>
> OK, I in fact prefer to generate the nonce in elisp.
>
>> That would still break backward compatibility, wouldn't it?  The old
>> servers would not accept this command anyway.  Unless server would issue
>> it to client just after making connection.  From what I see, the old
>> clients would "only" print error message.

> Yeah, but a failed -auth closes the connection and deletes the
> process, while an unknown command just issues an error message.

My reading of searver.el is that anything other then -auth is consider
a failed authentication.

How about adding additional information to the server file which would
just be ignored by old clients but new client would read it and use the
new authentication.  My reading of emacsclient.c is that it ignores
anything after reading the key.

Actually, now that I look at it, it seems that the patch needs some more
works since both server and client have some assumption about the key
(eg. client reads exactly 64 bytes).  I'll take care of it on Monday.

-- 
Best regards,                                          _     _
 .o. | Liege of Serenly Enlightened Majesty of       o' \,=./ `o
 ..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
 ooo +-<mina86-mina86.com>-<jid:mina86-jabber.org>--ooO--(_)--Ooo--

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Juanma Barranquero]

2011/5/1 Michal Nazarewicz <mina86@mina86.com>:

> My reading of searver.el is that anything other then -auth is consider
> a failed authentication.

Yes, sorry, my mistake.

> How about adding additional information to the server file which would
> just be ignored by old clients but new client would read it and use the
> new authentication.  My reading of emacsclient.c is that it ignores
> anything after reading the key.

That's a good idea.

> Actually, now that I look at it, it seems that the patch needs some more
> works since both server and client have some assumption about the key
> (eg. client reads exactly 64 bytes).  I'll take care of it on Monday.

Which patch, yours adding server-auth-key you mean?

    Juanma

Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

[-- Attachment #1: Type: text/plain, Size: 763 bytes --]

> 2011/5/1 Michal Nazarewicz <mina86@mina86.com>:
>> Actually, now that I look at it, it seems that the patch needs some more
>> works since both server and client have some assumption about the key
>> (eg. client reads exactly 64 bytes).  I'll take care of it on Monday.

Juanma Barranquero <lekktu@gmail.com> writes:
> Which patch, yours adding server-auth-key you mean?

Yep.  It at least needs clarification that key must be 64-char long with
only printable US-ASCII characters.

-- 
Best regards,                                          _     _
 .o. | Liege of Serenly Enlightened Majesty of       o' \,=./ `o
 ..o | Computer Science,  Michal "mina86" Nazarewicz    (o o)
 ooo +-<mina86-mina86.com>-<jid:mina86-jabber.org>--ooO--(_)--Ooo--

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

[PATCHv2] lisp/server.el: Introduction of server-auth-key variable

[Michal Nazarewicz]

This commit adds a server-auth-key variable which allows
user to specify a default authentication key used by the
server process.
---
 lisp/server.el |   61 +++++++++++++++++++++++++++++++++++++++++++++++++------
 1 files changed, 54 insertions(+), 7 deletions(-)

This is an updated version of my previous patch.  It now validates whether
a key specified via server-auth-key is a valid key (meaning 64 printable
characters).

diff --git a/lisp/server.el b/lisp/server.el
index cb1903a..e96f77f 100644
--- a/lisp/server.el
+++ b/lisp/server.el
@@ -134,6 +134,33 @@ directory residing in a NTFS partition instead."
 ;;;###autoload
 (put 'server-auth-dir 'risky-local-variable t)
 
+(defcustom server-auth-key nil
+  "Server authentication key.
+
+Normally, authentication key is generated on random when server
+starts, which guarantees some level of security.  It is
+recommended to leave it that way.  Using a long-lived shared key
+may decrease security (especially since the key is transmitted as
+plain text).
+
+In some situations however, it can be difficult to share randomly
+generated password with remote hosts (eg. no shared directory),
+so you can set the key with this variable and then copy server
+file to remote host (with possible changes to IP address and/or
+port if that applies).
+
+The key must consist of 64 US-ASCII printable characters except
+for space (this means characters from ! to ~; or from code 33
+to 126).
+
+You can use \\[server-generate-key] to get a random authentication
+key."
+  :group 'server
+  :type '(choice
+	  (const :tag "Random" nil)
+	  (string :tag "Password"))
+  :version "24.0")
+
 (defcustom server-raise-frame t
   "If non-nil, raise frame when switching to a buffer."
   :group 'server
@@ -501,6 +528,32 @@ See variable `server-auth-dir' for details."
       (unless safe
 	(error "The directory `%s' is unsafe" dir)))))
 
+(defun server-generate-key ()
+  "Generates and returns a random 64-byte strings of random chars
+in the range `!'..`~'. If called interactively, also inserts it
+into current buffer."
+  (interactive)
+  (let ((auth-key
+	 (loop repeat 64
+	       collect (+ 33 (random 94)) into auth
+	       finally return (concat auth))))
+    (if (called-interactively-p)
+	(insert auth-key))
+    auth-key))
+
+(defun server-get-auth-key ()
+  "Returns server's authentication key.
+
+If `server-auth-key' is nil this function will just call
+`server-generate-key'.  Otherwise, if `server-auth-key' is
+a valid authentication it will return it.  Otherwise, it will
+signal an error."
+  (if server-auth-key
+    (if (string-match "^[!-~]\\{64\\}$" server-auth-key)
+        server-auth-key
+      (error "The key '%s' is invalid" server-auth-key))
+    (server-generate-key)))
+
 ;;;###autoload
 (defun server-start (&optional leave-dead inhibit-prompt)
   "Allow this Emacs process to be a server for client processes.
@@ -594,13 +647,7 @@ server or call `M-x server-force-delete' to forcibly disconnect it.")
 	  (unless server-process (error "Could not start server process"))
 	  (process-put server-process :server-file server-file)
 	  (when server-use-tcp
-	    (let ((auth-key
-		   (loop
-		      ;; The auth key is a 64-byte string of random chars in the
-		      ;; range `!'..`~'.
-		      repeat 64
-		      collect (+ 33 (random 94)) into auth
-		      finally return (concat auth))))
+	    (let ((auth-key (server-get-auth-key)))
 	      (process-put server-process :auth-key auth-key)
 	      (with-temp-file server-file
 		(set-buffer-multibyte nil)
-- 
1.7.3.1