nerdexam
GIAC

GPEN · Question #54

Which of the following encryption encoding techniques is used in the basic authentication method?

The correct answer is A. Base64. HTTP Basic Authentication encodes the username and password using Base64, which is an encoding scheme and not encryption.

Web Application Penetration Testing

Question

Which of the following encryption encoding techniques is used in the basic authentication method?

Options

  • ABase64
  • BDES (ECB mode)
  • CHMAC_MD5
  • DMd5

How the community answered

(27 responses)
  • A
    70% (19)
  • B
    19% (5)
  • C
    4% (1)
  • D
    7% (2)

Why each option

HTTP Basic Authentication encodes the username and password using Base64, which is an encoding scheme and not encryption.

ABase64Correct

In HTTP Basic Authentication, the client concatenates the username and password with a colon (username:password) and encodes the result using Base64, then sends it in the Authorization header. Base64 is a binary-to-text encoding scheme, not a cryptographic operation, meaning the credentials are trivially reversible. This is why Basic Authentication must always be used over HTTPS to provide actual confidentiality.

BDES (ECB mode)

DES in ECB mode is a symmetric block cipher used for encryption, not the encoding mechanism employed by HTTP Basic Authentication.

CHMAC_MD5

HMAC-MD5 is a keyed hash function used for message integrity and authentication, not for encoding credentials in Basic Auth headers.

DMd5

MD5 is a one-way cryptographic hash function and cannot be used as a reversible encoding scheme, so it is not used in Basic Authentication.

Concept tested: HTTP Basic Authentication Base64 credential encoding

Source: https://www.rfc-editor.org/rfc/rfc7617

Topics

#basic authentication#Base64#HTTP authentication#encoding

Community Discussion

No community discussion yet for this question.

Full GPEN Practice