One of the videos that I've included before.
This lecture is about hashing.
Now, I have taken that video from our intensive ethical hacking course.
So the reason why I decided to include the hashing video was because hashing is something which is very
important that you understand, not just for security, but also for the next Http authentication,
which is digest authentication, which relies completely on hashing.
So before we go into the Http digest authentication, let's again revise the basic authentication and
one of the fundamental flaws of that.
So.
One of the things again, the client sends the get request for slash admin page.
Now as the admin page is having the basic authentication method, so the server sends the authenticate
header with the basic authentication type.
And in order for client to verify, the client actually sends the base64 encoded value of username and
password.
Now, we've already seen that if a hacker is sniffing the traffic, then he can actually get the base64
encoded value and can easily decode it within few minutes.
So, in fact, even if you have a pen and paper, you can actually decode the base64 value within a
few minutes.
So this was one of the fundamental flaws of the Http basic authentication.
And this is why if you want to implement basic authentication, then try to use it on top of SSL.
So now let's talk about digest authentication.
Now, one of the reasons of digest authentication was to provide an advantage over the basic authentication.
So again, in digest authentication, the first step remains the same, where the client sends a get
request for slash admin page.
Now in this second response, which is the 401.
As similar to basic authentication here, you see the realm has changed from basic to digest, and there
is two more values that have been added generally.
One is the nouns and one is the.
Now in the third request.
If you see in the response generally the base 64 encode which the.
Basic authentication used to send now instead of this.
This is basic in digest.
It sends the MD5 digest or I would say MD5 value.
So we have already seen that the.
Hash value cannot be a two way function.
It is just a one way function.
Now the question is how the hash value is calculated in digest authentication.
So let's see.
So the first step generally that happens is.
So first the username, plus the password.
Plus the.
Erin.
Are calculated.
Let's say this is H1 and the MD5 of these three things are taken.
Then there is a H2 value that is calculated, which is the Uri.
As a Uri plus the request method.
So you or I will be slash admin and request method would be get and the MD5 of this is taken.
Now, once H1 and H2 are calculated, then both the MD5 value.
So say MD5 of H1.
MD5 of H2.
Is taken and then a nonce value is added.
And then for all of these three things, one more MD5 hash is taken and that MD5 hash goes as a response.
To the server.
Now, if you're wondering about what a nonce value is.
So there is a concept called as nouns, which is included in the digest authentication.
So basically this is used to prevent replay attacks.
So let's say a hacker captures this response and after one hour, he decides to send the same response
back to the server.
Now, as the username, password and realms are correct, ideally server should be able to verify it.
So this is one of the flaws.
So what happens in digest authentication?
Nonce value is added and this nonce value keeps on changing every interval.
So even if Hacker captures this particular request and replays it, after half an hour, he won't be
able to get the authentication because the nonce value has changed.
And because the nonce value has changed the whole.
MD5.
The whole MD5 value has also changed.
So this is one of the ways in which the digest authentication works.
Now, generally as far as Nginx plus is concerned, it does not really support the Http digest authentication.
So we will not be including the practical part of digest authentication for this course.
However, just for knowledge purpose, I decided to include digest authentication.
So if you're using Apache, then you can actually implement the digest authentication there.
So I hope the basic overview concept of digest authentication is clear to you, and the difference between
a basic and digest is also clear.
So I hope this video has been informative for you and I'd like to thank you for viewing.