full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Mar 13 22:23:02 2006
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: HTTP AUTH BASIC monowall.

On Mon, 13 Mar 2006, Jeremy Bishop wrote:

> I suggest "password-authenticated key agreement" as a starting point for 
> research outside the traditional public-key methods.  (Although, as far 
> as I can tell, it would require the "password" to be accessible to the 
> server so that the session can be set up.  IOW, you get around the 
> problems of trusting a cert, but you're back to storing passwords in 
> plaintext.)

A moderate dose of modular exponentiation magic can overcome the need
to store plaintext passwords on the server. See SRP
<http://srp.stanford.edu/> et al.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."