=== modified file 'TODO'
--- TODO	2008-09-03 17:11:32 +0000
+++ TODO	2008-09-03 17:34:29 +0000
@@ -8,9 +8,6 @@
 ** [#B] Seperate more code to function for more readability
 
 * password-request
-** [#A] Man page: man8/password-request.8mandos
-*** SEE ALSO
-    Update from mandos.xml
 ** [#B] Temporarily lower kernel log level
    for less printouts during sucessfull boot.
 ** IPv4 support

=== modified file 'plugins.d/password-request.xml'
--- plugins.d/password-request.xml	2008-09-03 17:11:32 +0000
+++ plugins.d/password-request.xml	2008-09-03 17:34:29 +0000
@@ -336,8 +336,10 @@
       <filename>/etc/crypttab</filename>, but it would then be
       impossible to enter a password for the encrypted root disk at
       the console, since this program does not read from the console
-      at all.  This is why a separate plugin does that, which will be
-      run in parallell to this one by the plugin runner.
+      at all.  This is why a separate plugin (<citerefentry>
+      <refentrytitle>password-prompt</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>) does that, which
+      will be run in parallell to this one by the plugin runner.
     </para>
   </refsect1>
   
@@ -446,7 +448,8 @@
     <title>SECURITY</title>
     <para>
       This program is set-uid to root, but will switch back to the
-      original user and group after bringing up the network interface.
+      original (and presumably non-privileged) user and group after
+      bringing up the network interface.
     </para>
     <para>
       To use this program for its intended purpose (see <xref
@@ -474,16 +477,27 @@
       >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
     </para>
     <para>
-      <emphasis>Note</emphasis>: This makes it impossible to have
-      <application >Mandos</application> clients which dual-boot to
-      another operating system which does <emphasis>not</emphasis> run
-      a <application>Mandos</application> client.
+      It will also help if the checker program on the server is
+      configured to request something from the client which can not be
+      spoofed by someone else on the network, unlike unencrypted
+      <acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
+    </para>
+    <para>
+      <emphasis>Note</emphasis>: This makes it completely insecure to
+      have <application >Mandos</application> clients which dual-boot
+      to another operating system which is <emphasis>not</emphasis>
+      trusted to keep the initial <acronym>RAM</acronym> disk image
+      confidential.
     </para>
   </refsect1>
 
   <refsect1 id="see_also">
     <title>SEE ALSO</title>
     <para>
+      <citerefentry><refentrytitle>cryptsetup</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>crypttab</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>mandos</refentrytitle>
       <manvolnum>8</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>password-prompt</refentrytitle>
@@ -491,42 +505,121 @@
       <citerefentry><refentrytitle>plugin-runner</refentrytitle>
       <manvolnum>8mandos</manvolnum></citerefentry>
     </para>
-    <itemizedlist>
-      <listitem><para>
-	<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
-      </para></listitem>
-      
-      <listitem><para>
-	<ulink url="http://www.avahi.org/">Avahi</ulink>
-      </para></listitem>
-      
-      <listitem><para>
-	<ulink
-	    url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
-      </para></listitem>
-      
-      <listitem><para>
-	<ulink
-	url="http://www.gnupg.org/related_software/gpgme/"
-	>GPGME</ulink>
-      </para></listitem>
-      
-      <listitem><para>
-	<citation>RFC 4880: <citetitle>OpenPGP Message
-	Format</citetitle></citation>
-      </para></listitem>
-      
-      <listitem><para>
-	<citation>RFC 5081: <citetitle>Using OpenPGP Keys for
-	Transport Layer Security</citetitle></citation>
-      </para></listitem>
-      
-      <listitem><para>
-	<citation>RFC 4291: <citetitle>IP Version 6 Addressing
-	Architecture</citetitle>, section 2.5.6, Link-Local IPv6
-	Unicast Addresses</citation>
-      </para></listitem>
-    </itemizedlist>
+    <variablelist>
+      <varlistentry>
+	<term>
+	  <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
+	</term>
+	<listitem>
+	  <para>
+	    Zeroconf is the network protocol standard used for finding
+	    Mandos servers on the local network.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <ulink url="http://www.avahi.org/">Avahi</ulink>
+	</term>
+      <listitem>
+	<para>
+	  Avahi is the library this program calls to find Zeroconf
+	  services.
+	</para>
+      </listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <ulink url="http://www.gnu.org/software/gnutls/"
+	  >GnuTLS</ulink>
+	</term>
+      <listitem>
+	<para>
+	  GnuTLS is the library this client uses to implement TLS for
+	  communicating securely with the server, and at the same time
+	  send the public OpenPGP key to the server.
+	</para>
+      </listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  <ulink url="http://www.gnupg.org/related_software/gpgme/"
+		 >GPGME</ulink>
+	</term>
+	<listitem>
+	  <para>
+	    GPGME is the library used to decrypt the OpenPGP data sent
+	    by the server.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  RFC 4291: <citetitle>IP Version 6 Addressing
+	  Architecture</citetitle>
+	</term>
+	<listitem>
+	  <variablelist>
+	    <varlistentry>
+	      <term>Section 2.2: <citetitle>Text Representation of
+	      Addresses</citetitle></term>
+	      <listitem><para/></listitem>
+	    </varlistentry>
+	    <varlistentry>
+	      <term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
+	      Address</citetitle></term>
+	      <listitem><para/></listitem>
+	    </varlistentry>
+	    <varlistentry>
+	    <term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
+	    Addresses</citetitle></term>
+	    <listitem>
+	      <para>
+		This client uses IPv6 link-local addresses, which are
+		immediately usable since a link-local addresses is
+		automatically assigned to a network interfaces when it
+		is brought up.
+	      </para>
+	    </listitem>
+	    </varlistentry>
+	  </variablelist>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  RFC 4346: <citetitle>The Transport Layer Security (TLS)
+	  Protocol Version 1.1</citetitle>
+	</term>
+      <listitem>
+	<para>
+	  TLS 1.1 is the protocol implemented by GnuTLS.
+	</para>
+      </listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
+	</term>
+      <listitem>
+	<para>
+	  The data received from the server is binary encrypted
+	  OpenPGP data.
+	</para>
+      </listitem>
+      </varlistentry>
+      <varlistentry>
+	<term>
+	  RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
+	  Security</citetitle>
+	</term>
+      <listitem>
+	<para>
+	  This is implemented by GnuTLS and used by this program so
+	  that OpenPGP keys can be used.
+	</para>
+      </listitem>
+      </varlistentry>
+    </variablelist>
   </refsect1>
 
 </refentry>