Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.

When the user enters the password, is the password encrypted and sent, or is the hash of the password encrypted and sent? Is a time-stamp or a nonce used? If the digest of the password is sent, when is the salt added?

Typical scenarios would be login without https.

share|improve this question
up vote 2 down vote accepted

It depends on the particular scheme. In a simple challenge-response scheme, the server sends a challenge, the client "encrypts" the challenge and the password to form a response, and then the client sends the response over the wire.

However, standard logins typically don't use challenge/response. The password is just sent to the server by the client. When using SSL/HTTPs, the password is protected by the encryption of the channel. When using ordinary HTTP, there's no protection whatsoever. With no security on the channel itself, even with a challenge/response protocol, an attacker can simply proxy the authentication portion of the protocol between the client and server and then takeover the authenticated connection after that phase completes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.