GSLC · Question #283
Which of the following statements about Digest authentication are true? Each correct answer represents a complete solution. Choose two.
The correct answer is A. Digest authentication is a more secure authentication method as compared to Basic authentication. B. In Digest authentication, passwords are sent across a network as a hash value, rather than as clear text. Digest authentication improves on Basic authentication by transmitting a hashed representation of the password rather than the plaintext credential.
Question
Which of the following statements about Digest authentication are true? Each correct answer represents a complete solution. Choose two.
Options
- ADigest authentication is a more secure authentication method as compared to Basic authentication.
- BIn Digest authentication, passwords are sent across a network as a hash value, rather than as clear text.
- CDigest authentication is used by wireless LANs, which follow the IEEE 802.11 standard.
- DIn Digest authentication, passwords are sent across a network as clear text, rather than as a has value.
How the community answered
(57 responses)- A91% (52)
- C7% (4)
- D2% (1)
Why each option
Digest authentication improves on Basic authentication by transmitting a hashed representation of the password rather than the plaintext credential.
Digest authentication is more secure than Basic authentication because Basic authentication encodes credentials in Base64 (which is trivially reversible) and sends them in near-plaintext, whereas Digest uses a challenge-response mechanism with MD5 hashing, making credential interception significantly harder.
In Digest authentication, the client applies a hash function (typically MD5) to the password combined with a server-provided nonce and sends only the hash value across the network, ensuring the actual password is never transmitted in clear text.
IEEE 802.11 wireless LANs use authentication mechanisms such as WEP, WPA/WPA2 (PSK or Enterprise/802.1X), and WPA3 - not HTTP Digest authentication, which is an application-layer protocol defined in RFC 7616.
This statement describes Basic authentication, not Digest authentication - Digest authentication specifically exists to avoid sending passwords as clear text by using hash values instead.
Concept tested: HTTP Digest authentication mechanism and security comparison
Source: https://datatracker.ietf.org/doc/html/rfc7616
Topics
Community Discussion
No community discussion yet for this question.