Eugene Beresovksy

less info
130 reputation
6
bio website
location
age
visits member for 1 year, 9 months
seen Jun 30 at 23:22

Jun
29
revised Do Client Nonces enhance the security of HTTP Digest Auth?
deleted 3 characters in body
Jun
29
awarded  Popular Question
Oct
24
awarded  Commentator
Oct
24
comment How does “check.torproject.org.” know if you're using TOR?
@Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed?
Oct
17
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Re: mutual auth I can follow the RFC: the "response-auth" directive supports mutual authentication -- the server proves that it knows the user's secret, and with qop=auth-int also provides limited integrity protection of the response, according to which mutual auth is provided by the password, not the cnonce.
Oct
17
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 274 characters in body
Oct
16
awarded  Scholar
Oct
16
accepted Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
@DavidWachtfogel The attack you describe makes the advantage of a cNonce clear. Re: could be used to attack the same username on many users, I updated my question with details on Digest Auth that make it clear when and how that would work. All admin users, to stay in your example, who use Opera would be protected against that form of reuse,
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
+1 Thanks for reminding me of that important part of Pornin's answer.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 1261 characters in body
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Thanks for the realm comment. Just updated the question. In terms of the cnonce: So what you are saying is that the client could be stateless and would still be able to check if the cnonce originated from it? Otherwise, as the cnonce is sent as plaintext, it is not a shared secret or anything with even a minimum hurdle for an attacker to figure out.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 51 characters in body
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Hmm... still mulling over your mutual authentication comment. I don't see how the random cnonce helps providing authentication of the client to the server and a bit of searching still leaves me clueless. Would you care to elaborate or do you have a helpful link, perhaps?
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Re: realm - Sure, it's a value chosen by whoever implements / administers the service, and as such not necessarily unique, but in my case, I have control over this, and I chose something that is so unlikely to be used by any other server. So I don't worry about a rainbow table for that realm flying around.
Oct
16
awarded  Student
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
edited title
Oct
16
asked Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
12
awarded  Editor
Oct
12
revised How does SSL/TLS work?
SSL is not TCP only (see. http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Applications)