Blog

The Footprint of MD5 security on Digest Authentication

MD5 is a Hashing algorithm, which is a one-way cryptographic function which accepts the message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original message.

MD5 calculations which are used in HTTP digest authentication is “One-Way” which means that it is difficult to determine the original input when the output is the only thing known.

You would have known about Brute-Force Attack. Guessing all possible ways of identifying the password. If the password is too simple, there is a high possibility that Brute Force Attack could happen.

The Hypertext Transfer Protocol (HTTP) Authentication Framework, includes two authentication schemes mainly: Basic and Digest.

So what is Basic and Digest Authentications?

Digest Authentication communicates the credentials in an encrypted form by applying the hash function to the username, the password, a server supplied nonce value, the HTTP method, and the requested URI.

On the other hand, Basic Authentication uses unencrypted base64 encoding.

Moreover, Digest Scheme improves the security by hiding user credentials with cryptographic hashes, and additionally by providing limited message integrity.

ATLAS API

Atlas API uses HTTP Digest Authentication. The complete details of digest authentication are beyond the scope of this document, but it essentially requires a username and a password which are hashed using a unique server-generated value called a nonce.

The username is the username of the registered Atlas account, and the password is an API key associated with that account.

Using digest authentication in combination with HTTPS provides an additional layer of security by ensuring that a password is never transmitted back to the server.

So why you should use HTTP digest authentication:

• HTTP digest authentication is developed to be more secure than traditional digest authentication schemes.

• Some of the security strengths of HTTP digest authentication includes:
  
  
• The password is may not be sent clear to the server, thus preventing Phishing attacks if the user is tricked into accessing the wrong website.

• Client nonce was introduced which allows the client to prevent chosen-plaintext attacks, such as rainbow tables that could otherwise threaten digest authentication schemes.

• Server nonce is allowed to contain timestamps. So, the server may inspect nonce attributes submitted by clients, to prevent the replay attacks.

• Added, Server is also allowed to maintain a list of recently issued or used server nonce values to prevent reuse.

HTTP digest authentication is not good, since:

• When it comes to security, there are several drawbacks with digest access authentication:
  
  
• Many of the security options in RFC 2617 are optional here. If quality-of-protection (qop) is not given by the server, the client will operate in a security-reduced legacy RFC 2069 mode.

• Digest access authentication is more vulnerable to a man-in-the-middle (MITM) attack.

• Some servers may require passwords to be stored using reversible encryption.

• It also prevents the use of a strong password hash (such as bcrypt) when storing passwords.

• Additionally, since the MD5 algorithm is not allowed in FIPS, HTTP Digest authentication will not work with FIPS-certified crypto modules.

Final Words

Security has become an important concern since there are a lot of issues being stated every single day. One should remain updated with this information to be aware.

Hope this would have helped you!

Thanks for Reading!