How to decrypt the DIGEST authentication? 2007-11-05 - By Johnny Kewl
Back
-- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- --
HARBOR: http://coolharbor.100free.com/index.htm
Now Tomcat is also a cool pojo application server
-- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- --
-- -- Original Message -- --
From: "Mark Thomas" <markt@(protected)>
To: "Tomcat Users List" <users@(protected)>
Sent: Sunday, November 04, 2007 8:24 PM
Subject: Re: [tomcat]How to decrypt the DIGEST authentication?
> Mark Thomas wrote:
>> Johnny Kewl wrote:
>>> I dont think you can do what you want to...
>>> I dont think you can use web based DIGEST authentication.
>>> And then hide passwords in a MD5 digest as well.
>>
>> Yes you can.
>>
>>> I think web based DIGEST authentication, MUST get at the plain text
>>> password.
>>
>> No.
>>
>>> That process has to be repeated on the server, and SHA(Password) + plus
>>> some random stuff NOT EQUAL to browser...
>>> I think it has to be a plain text password... unless TC does something
>>> unbelievable...
>>
>> Not unbelievable. Just plain cold logic. The use of DIGEST auth and
>> digested passwords are 100% independent.
>
> Sorry. I mis-spoke. They are not totally independent. If you use DIGEST
> auth *and* digested passwords then you have to calculate the password to
> put in your tomcat-users.xml/database/etc differently. See
> http://tomcat.apache.org/tomcat-6 (See http://cat-6.ora-code.com).0-doc/realm-howto.html#Digested%20Passwords
> for details.
No Problem... I'm surprized it can even be done...
The digest spec has random vectors, so it means TC is using domain and
username as those.
-- ---- ------
If using digested passwords with DIGEST authentication, the cleartext used
to generate the digest is different. In the examples above
{cleartext-password} must be replaced with
{username}:{realm}:{cleartext-password}. For example, in a development
environment this might take the form testUser:localhost:8080:testPassword.
-- ---- ---- --
I was wrong... it can be done ;)
> Mark
>
>
> -- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ------
> To start a new topic, e-mail: users@(protected)
> To unsubscribe, e-mail: users-unsubscribe@(protected)
> For additional commands, e-mail: users-help@(protected)
>
>
-- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ------
To start a new topic, e-mail: users@(protected)
To unsubscribe, e-mail: users-unsubscribe@(protected)
For additional commands, e-mail: users-help@(protected)
|
|
