How is the password sent across for verification?

Question

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.

When the user enters the password, is the password encrypted and sent, or is the hash of the password encrypted and sent? Is a time-stamp or a nonce used? If the digest of the password is sent, when is the salt added?

Typical scenarios would be login without https.

Answer 1

It depends on the particular scheme. In a simple challenge-response scheme, the server sends a challenge, the client "encrypts" the challenge and the password to form a response, and then the client sends the response over the wire.

However, standard logins typically don't use challenge/response. The password is just sent to the server by the client. When using SSL/HTTPs, the password is protected by the encryption of the channel. When using ordinary HTTP, there's no protection whatsoever. With no security on the channel itself, even with a challenge/response protocol, an attacker can simply proxy the authentication portion of the protocol between the client and server and then takeover the authenticated connection after that phase completes.