In this part, you? Will be working with HTTP\'s Digest authentication mechanism.

Question

In this part, you? Will be working with HTTP's Digest authentication mechanism. Assume that accessing a resource "/Public/CS/Home. Png" on a web server results in the following (partial) response. HTTP/1.1 401 Unauthorized WWW-Authenticate: Digest realm="Mordor", nonce="03e2abb8a924e966bee59d41cef32851", opaque="4043168947418128" Part 2A Assuming that the user name is 8688049 and the password is 9408868, the HTTP Authorization header line sent by the client (e.g., browser) following the above notification for authentication will be of the following form. Authorization: Digest username="8688049", response=",,/realm="Mordor", nonce="03e2abb8a924e966bee59d41cef32851", uri="/Public/CS/Home. Png", opaque="4043168947418128" What should be the value of the "response" field which currently is empty? Please do NOT include the quotation marks (i. E.,") in your answer. You must use lowercase hexadecimal digits in your answer, if applicable. In order to safeguard against server compromises, the server stores a hash value tht includes the password (and other things) and uses this hash value for authentication. In this particular example here, what is the hash value you expect the server to keep in its repository? You must use lowercase hexadecimal digits in your answer, if applicable. Part 2CA man-in-thc-middle attack found the following HTTP Authorization header in transit.Authorization: Digest username="8688049"/response="bfc7fd8930c8fIf94ba9bde3d7808c5e", realm="Mordor", nonce="03e2abb8a924e966bee59d41cef32851", uri="/Public/CS/Home. Png", opaque="4043168947418128" What is the password that gives rise to the above HTTP Authorization header? The password is thought to be a common dictionary word, and therefore you may wish to try some of the common English words.

Explanation / Answer

String HA1

String HA2

response = MD5(String MD5 (username:Realm:PassWord):nonce: String MD5 (method:digestURI))

steps for calculating the response value:

1. compute the MD5 hash value of the user name, authentication realm and password in combination

2. the response from the client is computed as a combination of HA1 results, server nonce, counter of the request, nonce of the client, the code for protection quality and the result from HA2

HA1 = MD5(“8688049:

plugging in the values or applying the above equation,

Part 2A) Response = after MD5 hashing the response code of “7A5234B786329CAB5D6EFFF4421” becomes bfc7fd8930c8f1f94ba9bde3d78008c5e

Parts 2B, 2C)

HA1 = MD5(“8688049:Mordor:password”)

= 8734ab23645e7532d9364a32b3e3dd3ed887

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.