Http- Security- Digest Authentication

We have already talked about the basic authentication. And we also saw the issues with Basic Authentication. Digest Authentication is more secure. In this, as the client present the request to server.


GET /dir/index.html HTTP/1.0
Host: localhost


Server responds with the following challenge.


HTTP/1.0 401 Unauthorized
Server: HTTPd/0.9
Date: Sun, 10 Apr 2005 20:26:47 GMT
WWW-Authenticate: Digest realm="testrealm@host.com",
qop="auth,auth-int",
nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
opaque="5ccc069c403ebaf9f0171e9517f40e41"
Content-Type: text/html
Content-Length: 311
(plus html for the 401 Unauthorized text)


"WWW-Authenticate: Digest" tells the browser that it has to use the digest authentication. Browser will first pops-up the window in which the user types the user name and password. Once the browser has this information it performs the following steps.

1. Browser will generate the HashNumber of username:realm:password.
N1 = H(username:realm:password)

2. Browser will then generate one nonce( nonce stands for number user once, this is kind of UUID). It will also generate the request number. Then it will create one more hash
N2 = H(N1:browser nonce:browser request number: server nonce)

3. Browser will send this information back to server in "Authorization" http header in the following format. The actual hash value N2 is the value in response field( see below)


GET /dir/index.html HTTP/1.0
Host: localhost
Authorization: Digest username="Mufasa",
realm="testrealm@host.com",
nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
uri="/dir/index.html",
qop=auth,
nc=00000001,
cnonce="0a4f113b",
response="6629fae49393a05397450978507c4ef1",
opaque="5ccc069c403ebaf9f0171e9517f40e41"


4. On server side the password for various users are not stored in plain text. Server will keep the same hash of username:realm:password(It will be same as N1 in step 1) and thus it will save cpu time. Server will use the username value to retrieve the corresponding hash N1. Now server will use all other information nc(request number), conce(browser nonce), nonce(server nonce) from the reuest to calculate the hash N2. If everything is correct then this generated value should be same as value in reposne field.

5. Now the server will present the requested page to client.


HTTP/1.0 200 OK
Server: HTTPd/0.9
Date: Sun, 10 Apr 2005 20:27:03 GMT
Content-Type: text/html
Content-Length: 7984
(followed by a blank line and HTML text of the restricted page).


MD5 is the hashing algorithm(H in our case) which is widely used for generating the hash value. This algorithm converts any string to 128 bit value. It's not easy to crack it and it is highly unlikely that by looking at the Hash one can tell the original value.

Advantages

The main advantage is that the password can not be retrieved from the data that is travelling over the network.

Replay Attack
In Basic Authentication, if a person retrieves the authorization header string; He can use it to start a new conversation with the server. So he can replay that string till the time user changes his/her password. He can start a new conversation with the server any time he wants.

Digest authentication provides security against these attacks. Since the digest values also includes server nonce, browser nonce( which changes very frequently probably in milli seconds) and request number( which changes for every request); the digest that travels in the response field doesn't remain the same. So the same digest can not be replayed by some bad soul. So he can not start the conversation with the server. Because he can not generate the digest of username:realm:password. And by looking at the digest, he can not guess the username and password.

Man-In-The-Middle Attack
If there is a person who is intercepting each and every request, then even this authentication fails. He will intercept every digest send to the server and can modify the content which is being send over the network. But this will work till when the actual user is talking to the server. It is like person A is calling to person B and person C is also listening ( map be modifying the conversation as well). But person C can not start a new conversation with person B.

So then what is secure
Basic or Digest authentication are just the Authentication mecanism. The information that travels over the network is still plain text. It will not protect the Credit card number and all other sesitive information travelling over the network. For that one will have to use SSL(Secure Sockets Layer)/TLS(Transport Layer Security)...