[lemma=the | lemma=","] [lemma=plaintext] [□] □
[lemma=the | lemma=","] [lemma=plaintext] [□=□] □
[lemma=the | lemma=","] [lemma=plaintext] [!□] □
Even if the stored value is compromised , the plaintext password must still be derived by exhaustive search . When the remote host password is kept as a one-way transformed value , and the algorithm for the transform function is implemented in the local server , the plaintext password SHOULD be locally transformed before comparison with the transformed password from the remote host . In addition , the salt used in the generation of the foreign TGS principal 's DES key from the plaintext password must be identical in the DCE cell and the Kerberos V5 realm . In any case , once the vali - dated PKa is installed , the plaintext password will no longer be accepted .