Eugene Beresovksy

less info
125 reputation
5
bio website
location
age
visits member for 1 year, 6 months
seen Jan 16 at 0:27

Oct
24
awarded  Commentator
Oct
24
comment How does “check.torproject.org.” know if you're using TOR?
@Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed?
Oct
17
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Re: mutual auth I can follow the RFC: the "response-auth" directive supports mutual authentication -- the server proves that it knows the user's secret, and with qop=auth-int also provides limited integrity protection of the response, according to which mutual auth is provided by the password, not the cnonce.
Oct
17
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 274 characters in body
Oct
16
awarded  Scholar
Oct
16
accepted Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
@DavidWachtfogel The attack you describe makes the advantage of a cNonce clear. Re: could be used to attack the same username on many users, I updated my question with details on Digest Auth that make it clear when and how that would work. All admin users, to stay in your example, who use Opera would be protected against that form of reuse,
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
+1 Thanks for reminding me of that important part of Pornin's answer.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 1261 characters in body
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Thanks for the realm comment. Just updated the question. In terms of the cnonce: So what you are saying is that the client could be stateless and would still be able to check if the cnonce originated from it? Otherwise, as the cnonce is sent as plaintext, it is not a shared secret or anything with even a minimum hurdle for an attacker to figure out.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 51 characters in body
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Hmm... still mulling over your mutual authentication comment. I don't see how the random cnonce helps providing authentication of the client to the server and a bit of searching still leaves me clueless. Would you care to elaborate or do you have a helpful link, perhaps?
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Re: realm - Sure, it's a value chosen by whoever implements / administers the service, and as such not necessarily unique, but in my case, I have control over this, and I chose something that is so unlikely to be used by any other server. So I don't worry about a rainbow table for that realm flying around.
Oct
16
awarded  Student
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
edited title
Oct
16
asked Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
12
awarded  Editor
Oct
12
revised How does SSL work?
SSL is not TCP only (see. http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Applications)
Oct
12
suggested suggested edit on How does SSL work?
Oct
10
comment CRIME - How to beat the BEAST successor?
@FlorianMargaine In case you didn't know, ThomasPornin is a paid bait ;) - a tasty one, admittedly.