IPP Mail Archive: Re: IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

IPP Mail Archive: Re: IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

Re: IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

Michael Sweet (mike@easysw.com)
Mon, 12 Apr 1999 13:41:38 -0400

Paul Leach wrote:
> ...
> That's a non-sequiter. It does not contradict Larry's statement at
> all.

No, but his statement implied that Digest is immune from passive
attacks, which for many/most of the current implementations it is NOT.

> Digest with a strong password is proof against passive attacks (such
> as sniffing). Basic isn't.

It has nothing to do with the "strength" of the password (what does
that even mean???), but it has everything to do with what level of
protection a server implementation provides, basically how often the
nonce value is changed and whether or not the server does message
body authentication.

The Apache Digest authentication module, for example, seems to accept
any incoming nonce value for authorization.

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products                  mike@easysw.com
Printing Software for UNIX                       http://www.easysw.com