Tagged Questions
4
votes
2answers
321 views
Do Client Nonces enhance the security of HTTP Digest Auth?
As far as I understand the answer at
http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
1
vote
3answers
287 views
Three Message Authentication Protocol
I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
6
votes
3answers
587 views
chosen plaintext attacks against MD5 and SHA1
According to http://tools.ietf.org/html/rfc2617#section-4.9, having the server chose a nonce but not having the client chose a nonce opens up Digest Access authentication to chosen plaintext attacks. ...
27
votes
4answers
5k views
What is the use of a client nonce?
After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
