4
votes
2answers
444 views

Is HTTP Digest + MD5 still an alternative to consume my own api?

I'm reading a lot about implementing security constraints to a REST API. There are a lot of methods, some better than others for 3party applications or to consume my own API. HTTP Basic + TLS (with ...
1
vote
2answers
423 views

Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
5
votes
2answers
1k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...