Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm designing an authentication methods for my client/server system consisting of:

  • a windows desktop client application (.NET)
  • windows/linux servers (C++)
  • one "security server" which authorizes the users and passes some tokens for single sign on to the other servers

A user would login providing username and a password to the security server with I think a simple hashing password + salt or some challenge-response algorithm. On successful login the returned auth token the user could present to the server that would automatically authenticate them.

Note: I know that I could just use SSL, but I would like to (for some reasons) Note2: The communication doesn't need to be encrypted by default (it would be in "half" trusted environment)

What I have found that the Kerberos looks quite similiar and it it seems that my security server would be a simplified Kerberos server.

I think I would need:

  • authenication protocol (client-security server)
  • algorithm for token generation and its verification

Any suggestions? Where to start?

share|improve this question

migrated from crypto.stackexchange.com Apr 18 at 16:04

This question came from our site for software developers, mathematicians and others interested in cryptography.

    
"I know that I could just use SSL, but I would like to (for some reasons)" - What does that mean? Did you leave out some words? What would you like to? And what are the reasons? The first question a security professional is probably going to ask is: why not just use SSL? I encourage you to edit the question to make this clearer, if you'd like to get useful responses. –  D.W. Apr 18 at 15:51
    
Sorry for late reply. The main reason I don't want SSL is the performance - which has a bigger priority for me. I know that making my own security won't beat SSL's but as I said before: the system will run on intranet so security has lower priority than a performance. –  ternyk Apr 22 at 7:44
    
Have you benchmarked the performance of SSL? There are a lot of misconceptions and myths about the performance overhead of SSL; SSL can perform quite well. See, e.g., imperialviolet.org/2010/06/25/overclocking-ssl.html –  D.W. Apr 22 at 15:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.