141 reputation
2
bio website
location
age
visits member for 3 years, 5 months
seen Jun 28 '13 at 18:27

May
20
awarded  Teacher
Jul
11
awarded  Student
Jul
11
asked chosen plaintext attacks against MD5 and SHA1
Jul
11
comment What is the use of a client nonce?
It's pretty much the same question that's being asked here. I want to know what the use of a client nonce is. RFC2617 provides an answer but that answer doesn't make a lot of sense to me. Thomas Pornin provided an answer as well but his answer doesn't make a lot of sense to me either per my response to his answer.
Jul
10
answered What is the use of a client nonce?
Jul
10
comment What is the use of a client nonce?
In digest authentication the server sends a nonce and then the client sends that same nonce back. Seems to me that a client nonce is only really useful where the server is taking what the client says is the nonce at face value instead of what the server, itself, generated? If the HTTP connection was keep-alive it seems to me that the server could know what the nonce it just sent was.