Menu
As far as i understand, Digest authentication (which is a one way operation) hash the password and transmit the hashed data to the server. The server then will use the stored password, hash it and compare with equality against the received hash password. Supposed to be safe from middle man attack.
What i don't understand is if i'm the middle man hacker, i don't need the original password. Well just use the hash password since that is the one which the server will compared against.
So what's the use of this Digest authentication mechanism? Doesn't seem to work from this general overview.
249
Digest authentication is secure due to the way it passes authentication information over the network. Usernames and passwords are never sent. Instead, IIS uses a message digest (or hash) to verify the user's credentials.
Unlike the plaintext scheme used by Basic authentication, Digest authentication has the client send a hash of the client's information over the communication channel, therefore the client's user name and password are never sent over the network.
Digest authentication is a challenge-response scheme that is intended to replace Basic authentication. The server sends a string of random data called a nonce to the client as a challenge. The client responds with a hash that includes the user name, password, and nonce, among additional information.
The main difference between Basic Authentication and Digest Authentication is how the credentials sent through the network. Basic Authentication mechanism sends credentials in 'clear text'. Whereas, Digest Authentication sends credentials in MD5 hashed form.
Digest authentication doesn't work quite the way you've described.
Digest auth is a challenge-response protocol. To start the process the client requests a protected URL and the server responds with the realm and a nonce. The client uses the realm and nonce to calculate:
md5(md5(username:realm:password):nonce:md5(httpMethod:uri))
The nonce causes each authentication to produce a different hash value, and in doing so prevents replay attacks. Further, it does provide some (weak) protection against attackers listening in on your communication because the plaintext password doesn't pass over the wire, although this does not stop an attacker from cracking the hash once they have it.
88
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
