Have you considered stronger alternatives to your authentication scheme? The protection afforded to six bytes by RFC2865 is arguably weak.