Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm designing an authentication methods for my client/server system consisting of:

  • a windows desktop client application (.NET)
  • windows/linux servers (C++)
  • one "security server" which authorizes the users and passes some tokens for single sign on to the other servers

A user would login providing username and a password to the security server with I think a simple hashing password + salt or some challenge-response algorithm. On successful login the returned auth token the user could present to the server that would automatically authenticate them.

Note: I know that I could just use SSL, but I would like to (for some reasons) Note2: The communication doesn't need to be encrypted by default (it would be in "half" trusted environment)

What I have found that the Kerberos looks quite similiar and it it seems that my security server would be a simplified Kerberos server.

I think I would need:

  • authenication protocol (client-security server)
  • algorithm for token generation and its verification

Any suggestions? Where to start?

share|improve this question

migrated from Apr 18 '14 at 16:04

This question came from our site for software developers, mathematicians and others interested in cryptography.

"I know that I could just use SSL, but I would like to (for some reasons)" - What does that mean? Did you leave out some words? What would you like to? And what are the reasons? The first question a security professional is probably going to ask is: why not just use SSL? I encourage you to edit the question to make this clearer, if you'd like to get useful responses. – D.W. Apr 18 '14 at 15:51
Sorry for late reply. The main reason I don't want SSL is the performance - which has a bigger priority for me. I know that making my own security won't beat SSL's but as I said before: the system will run on intranet so security has lower priority than a performance. – ternyk Apr 22 '14 at 7:44
Have you benchmarked the performance of SSL? There are a lot of misconceptions and myths about the performance overhead of SSL; SSL can perform quite well. See, e.g., – D.W. Apr 22 '14 at 15:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.