4
votes
2answers
854 views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
7
votes
1answer
809 views

Is it possible to have stateless server nonces in HTTP Digest

When implementing a HTTP Digest server, there's the issue of nonces. Server nonces (as opposed to client nonces) must be issued by the server may be re-used by clients as long as the server allows ...