GPEN · Question #4
Which of the following statements is true about the Digest Authentication scheme?
The correct answer is B. A valid response from the client contains a checksum of the username, the password, the. Digest Authentication protects credentials by transmitting an MD5 hash checksum of the username, password, and request details rather than the plaintext password.
Question
Which of the following statements is true about the Digest Authentication scheme?
Options
- AIn this authentication scheme, the username and password are passed with every request,
- BA valid response from the client contains a checksum of the username, the password, the
- CThe password is sent over the network in clear text format.
- DIt uses the base64 encoding encryption scheme.
How the community answered
(22 responses)- A5% (1)
- B82% (18)
- C5% (1)
- D9% (2)
Why each option
Digest Authentication protects credentials by transmitting an MD5 hash checksum of the username, password, and request details rather than the plaintext password.
Passing the username and password with every request describes Basic Authentication behavior, not Digest - Digest sends a computed hash, not raw credentials.
In Digest Authentication, the client computes an MD5 hash (checksum) combining the username, password, server-supplied nonce, HTTP method, and requested URI. This hash is sent instead of the password, so the actual credential is never transmitted over the network in any readable form.
Sending the password in cleartext is the flaw of Basic Authentication without TLS, not Digest Authentication, which is specifically designed to avoid this.
Base64 encoding is used by Basic Authentication to encode credentials before transmission, not by Digest Authentication which uses MD5 hashing.
Concept tested: HTTP Digest Authentication hashing mechanism
Source: https://datatracker.ietf.org/doc/html/rfc7616
Topics
Community Discussion
No community discussion yet for this question.