Internet & Intranet Security Management - Risks & Solutions

Basic Access Authentication
The basic access authentication scheme is defined in the HTTP/1.0 specification (Fielding et al.,
1996) and is, therefore, most widely supported by Web browsers and servers. Upon receipt of an
unauthorized request for a protected resource, the server may send a 401 response with a challenge
entry in the header fields like:
WWW-Authenticate: Basic realm="Stock Database"
where "Stock Database" the name of the protected space (the so called realm) on the server. In order
to gain access, the client sends the username and password, separated by a single colon (":")
character, within a base64 encoded string in the ''Authorization" header field. For example, the Web
client uses the following header field to send the user-name "XXX" and the password "YYY":
Authorization: Basic WFhYOllZWQo=
If the user has supplied the correct user-name and password then the access to the document is given.
Digest Access Authentication
The digest access authentication scheme is mentioned in HTTP/1.1 (Fielding et al., 1996) and
defined in Franks et al. (1997) as an alternative to the basic access authentication scheme. Basic
access authentication suffers from the problem of passing the user's password unencrypted (base64
encoded) across the network. This is an easy target for an attack. Using the digest access
authentication scheme, the password is never sent across the network but instead, a hash value is
sent. Upon receipt of an unauthorized request for a protected resource, the server constructs a nonce
value, which is server-specified data string and should be uniquely generated each time a 401
response is made. This nonce value is then sent within the a WWW-Authenticate header field to the
Web client. The client constructs a digest in a predefined way (using MD5 (Rivest, 1992) per default)
from the user-name, the password, the realm, the given nonce value, the HTTP method, and the
request URI. The client resubmits the request including the digest in the "Authorization" header field.
The server recalculates the digest based on the information it holds and makes an authentication and
access decision based on whether it matches the user's digest. To prevent a replaying attack, the
server may re-challenge the client with a new nonce at any time.
Communication Security Service