Which of the following statements is true about the Digest Authentication scheme?

Question

Options

• AA valid response from the client contains a checksum of the username, the password, the given
• BIn this authentication scheme, the username and password are passed with every request, not
• CThe password is sent over the network in clear text format.
• DIt uses the base64 encoding encryption scheme.

• A
  72% (18)
• B
  4% (1)
• C
  16% (4)
• D
  8% (2)

Explanation

The Digest Authentication scheme is a replacement of the Basic Authentication scheme. This authentication scheme is based on the challenge response model. In Digest authentication, the password is never sent across the network in clear text format but is always transmitted as an MD5 digest of the user's password. In this way, the password cannot be determined with the help How does it work? In this authentication scheme, an optional header allows the server to specify the algorithm used to create the checksum or digest (by default, the MD5 algorithm). The Digest Authentication scheme provides the challenge using a randomly chosen value. This randomly chosen value is a server-specified data string which may be uniquely generated each time a 401 response is made. A valid response contains a checksum (by default, the MD5 checksum) of the username, the password, the given random value, the HTTP method, and the requested URL. In this way, the password is never sent in clear text format. Drawback: Although the password is not sent in clear text format, an attacker can gain access with the help of the digested password, since the digested password is really all the information needed to access the web site. Answer: B, C, D are incorrect. These statements are true about the Basic Authentication scheme.

No community discussion yet for this question.