I'm designing an authentication methods for my client/server system consisting of:

  • a windows desktop client application (.NET)
  • windows/linux servers (C++)
  • one "security server" which authorizes the users and passes some tokens for single sign on to the other servers

A user would login providing username and a password to the security server with I think a simple hashing password + salt or some challenge-response algorithm. On successful login the returned auth token the user could present to the server that would automatically authenticate them.

Note: I know that I could just use SSL, but I would like to (for some reasons) Note2: The communication doesn't need to be encrypted by default (it would be in "half" trusted environment)

What I have found that the Kerberos looks quite similiar and it it seems that my security server would be a simplified Kerberos server.

I think I would need:

  • authenication protocol (client-security server)
  • algorithm for token generation and its verification

Any suggestions? Where to start?

migrated from crypto.stackexchange.com Apr 18 '14 at 16:04

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • "I know that I could just use SSL, but I would like to (for some reasons)" - What does that mean? Did you leave out some words? What would you like to? And what are the reasons? The first question a security professional is probably going to ask is: why not just use SSL? I encourage you to edit the question to make this clearer, if you'd like to get useful responses. – D.W. Apr 18 '14 at 15:51
  • Sorry for late reply. The main reason I don't want SSL is the performance - which has a bigger priority for me. I know that making my own security won't beat SSL's but as I said before: the system will run on intranet so security has lower priority than a performance. – ternyk Apr 22 '14 at 7:44
  • Have you benchmarked the performance of SSL? There are a lot of misconceptions and myths about the performance overhead of SSL; SSL can perform quite well. See, e.g., imperialviolet.org/2010/06/25/overclocking-ssl.html – D.W. Apr 22 '14 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.