In a distributed office system, authentication data (such as passwords) must be managed in such a way that users and machines from different organizations can easily authenticate themselves to each other.The authentication facility must be secure, but user convenience, decentralized administration, and a capability for smooth, long-term evolution are also important.In addition, the authentication arrangements must not permit failures at a single node to cause systemwide down time.The design used in the Xerox 8000 Series products is described.This design anticipates applications in an opennetwork architecture where there are nodes from diverse sources and one node does not trust authentication checking done by other nodes.Furthermore, in some offices encryption will be required to authenticate data transmissions despite hostile intruders on the network.Requirements and design constraints when applying encryption for authentication in office systems are discussed.It is suggested that protocol standards for use in office systems should allow unencrypted authentication as well as two options for encrypted authentication.Issues that will arise as an office system evolves to deal with increasingly sophisticated threats from users of the system are described.