I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.
When the user enters the password, is the password encrypted and sent, or is the hash of the password encrypted and sent? Is a time-stamp or a nonce used? If the digest of the password is sent, when is the salt added?
Typical scenarios would be login without https.