The Experts below are selected from a list of 747 Experts worldwide ranked by ideXlab platform
Hu Hao - One of the best experts on this subject based on the ideXlab platform.
-
Research and Improvement of Secure Authentication Scheme Based on Session Initial Protocol
Computer Engineering, 2009Co-Authors: Hu HaoAbstract:Most Session Initial Protocol(SIP)Authentication schemes only provids client-to-server Authentication,and HTTP Digest Authentication is one of them.This paper analyzes the procedure and security of HTTP Digest Authentication,and describes the vulnerability and possible attacks to the protocol.According to the vulnerability and possible attacks,it presents an improved scheme,which achieves secure transfer of message,and analyzes its security.
Pu Jie-xin - One of the best experts on this subject based on the ideXlab platform.
-
Research on secure Authentication based on session initial protocol
Journal of Computer Applications, 2007Co-Authors: Pu Jie-xinAbstract:At present, most of the session initial protocol (SIP) Authentication schemes only provide client-to-server Authentication. And HTTP Digest Authentication is one of them. The weakness of this scheme in server spoofing and password guessing attacks was analyzed, and a more secure strategy was proposed which avoided these shortcomings. The experimental result illustrates that this proposed algorithm is effective.
Yuichi Ioku - One of the best experts on this subject based on the ideXlab platform.
-
Mutual Authentication Protocol for HTTP
2017Co-Authors: Yuichi Ioku, Kaoru Maeda, Yutaka Oiwa, Hiromitsu Takagi, Tatsuya Hayashi, Hajime WatanabeAbstract:This document specifies an Authentication scheme for the Hypertext Transfer Protocol (HTTP) that is referred to as either the Mutual Authentication scheme or the Mutual Authentication protocol. This scheme provides true mutual Authentication between an HTTP client and an HTTP server using password-based Authentication. Unlike the Basic and Digest Authentication schemes, the Mutual Authentication scheme specified in this document assures the user that the server truly knows the user's encrypted password.
-
HTTPAUTH Working Group Y. Oiwa Internet-Draft H. Watanabe Intended status: Experimental H. Takagi
2014Co-Authors: Kaoru Maeda, Tatsuya Hayashi, Yuichi IokuAbstract:This document specifies a mutual Authentication method for the Hyper-text Transfer Protocol (HTTP). This method provides a true mutual Authentication between an HTTP client and an HTTP server using password-based Authentication. Unlike the Basic and Digest Authentication methods, the Mutual Authentication method specified in this document assures the user that the server truly knows the user’s encrypted password. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is a
-
Mutual Authentication Protocol for HTTP draft-oiwa-http-mutualauth-12
2012Co-Authors: Yutaka Oiwa, Hiromitsu Takagi, Tatsuya Hayashi, Hajime Watanabe, B. Kihara, Yuichi IokuAbstract:This document specifies a mutual Authentication method for the Hyper-text Transport Protocol (HTTP). This method provides a true mutual Authentication between an HTTP client and an HTTP server using password-based Authentication. Unlike the Basic and Digest Authentication methods, the Mutual Authentication method specified in this document assures the user that the server truly knows the user’s encrypted password. This prevents common phishing attacks: a phishing attacker controlling a fake website cannot convince a user that he authenticated to the genuine website. Furthermore, even when a user authenticates to an illegitimate server, the server cannot gain any information about the user’s password. The Mutual Authentication method is designed as an extension to the HTTP protocol, and is intended to replace the existing Authentication methods used in HTTP (the Basic method, Digest method, and Authentication using HTML forms).
Prabath Siriwardena - One of the best experts on this subject based on the ideXlab platform.
-
basic Digest Authentication
2020Co-Authors: Prabath SiriwardenaAbstract:HTTP Basic Authentication and Digest Authentication are two Authentication schemes, used for protecting resources on the Web. Both are based on username- and password-based credentials. When trying to log in to a web site, if the browser presents you a dialog box asking your username and password, then most probably this web site is protected with HTTP basic or Digest Authentication. Asking the browser to challenge the user to authenticate is one of the quick and dirty ways of protecting a web site. None or at least very few web sites on the Internet today use HTTP basic or Digest Authentication. Instead, they use a nice form-based Authentication or their own custom Authentication schemes. But still some use HTTP basic/Digest Authentication to secure direct API-level access to resources on the Web.
-
Basic/Digest Authentication
Advanced API Security, 2019Co-Authors: Prabath SiriwardenaAbstract:HTTP Basic Authentication and Digest Authentication are two Authentication schemes, used for protecting resources on the Web. Both are based on username- and password-based credentials. When trying to log in to a web site, if the browser presents you a dialog box asking your username and password, then most probably this web site is protected with HTTP basic or Digest Authentication. Asking the browser to challenge the user to authenticate is one of the quick and dirty ways of protecting a web site. None or at least very few web sites on the Internet today use HTTP basic or Digest Authentication. Instead, they use a nice form-based Authentication or their own custom Authentication schemes. But still some use HTTP basic/Digest Authentication to secure direct API-level access to resources on the Web.
-
Advanced API Security: OAuth 2.0 and Beyond
2019Co-Authors: Prabath SiriwardenaAbstract:1. APIs Rule!.-2. Designing Security for APIs.-3. Securing APIs with Transport Layer Security (TLS).-4. OAuth 2.0 Fundamentals.-5. Edge Security with an API Gateway.-6. OpenID Connect (OIDC).-7. Message Level Security with JSON Web Signature.-8. Message Level Security with JSON Web Encryption.-9. OAuth 2.0 Profiles.-10. Accessing APIs via Native Mobile Apps.-11. OAuth 2.0 Token Binding.-12. Federating Access to APIs.-13. User Managed Access.-14. OAuth 2.0 Security -- 15. Patterns and Practices -- 16: A. The Evolution of Identity Delegation -- 17: B. OAuth 1.0 -- 18: C. How Transport Layer Security Works -- 19: D. UMA Evolution -- 20: E. Base64URL Encoding -- 21: F. Basic/Digest Authentication -- 22: G. OAuth 2.0 MAC Token Profile.
-
HTTP Basic/Digest Authentication
Advanced API Security, 2014Co-Authors: Prabath SiriwardenaAbstract:HTTP Basic Authentication and Digest Authentication are popular for protecting resources on the web. Both are based on usernames and passwords. HTTP/1.0 includes the specification for the Basic Access Authentication scheme, which takes the username and password over the network in cleartext. Hence it isn’t considered to be a secured way of authenticating users, unless it’s used over an externally secured system such as Transport Level Security (TLS). RFC 2617 defines the specification for HTTP’s Authentication framework (the original Basic Access Authentication scheme) and Digest Access Authentication, which is based on cryptographic hashes. Unlike Basic Authentication, Digest Authentication doesn’t take the user’s password over the wire in cleartext.
-
http basic Digest Authentication
2014Co-Authors: Prabath SiriwardenaAbstract:HTTP Basic Authentication and Digest Authentication are popular for protecting resources on the web. Both are based on usernames and passwords. HTTP/1.0 includes the specification for the Basic Access Authentication scheme, which takes the username and password over the network in cleartext. Hence it isn’t considered to be a secured way of authenticating users, unless it’s used over an externally secured system such as Transport Level Security (TLS). RFC 2617 defines the specification for HTTP’s Authentication framework (the original Basic Access Authentication scheme) and Digest Access Authentication, which is based on cryptographic hashes. Unlike Basic Authentication, Digest Authentication doesn’t take the user’s password over the wire in cleartext.
Yuqing Zhang - One of the best experts on this subject based on the ideXlab platform.
-
a new provably secure Authentication and key agreement mechanism for sip using certificateless public key cryptography
Computer Communications, 2008Co-Authors: Fengjiao Wang, Yuqing ZhangAbstract:The session initiation protocol (SIP) is considered as the dominant signaling protocol for calls over the Internet. However, SIP Authentication typically uses HTTP Digest Authentication, which is vulnerable to many forms of known attacks. This paper proposes a new secure Authentication and key agreement mechanism based on certificateless public-key cryptography (CL-PKC), named as SAKA, between two previously unknown parties, which provides stronger security assurances for SIP Authentication and media stream, and is provably secure in the CK security model. Due to using CL-PKC, SAKA effectively avoids the requirement of a large Public Key Infrastructure and conquers the key escrow problem in previous schemes.
-
CIS - A New Provably Secure Authentication and Key Agreement Mechanism for SIP Using Certificateless Public-Key Cryptography
2007 International Conference on Computational Intelligence and Security (CIS 2007), 2007Co-Authors: Fengjiao Wang, Yuqing ZhangAbstract:The Authentication procedure in session initiation protocol (SIP) typically uses HTTP Digest Authentication, which is vulnerable to many forms of known attacks. This paper proposes a new secure Authentication and key agreement mechanism based on certificateless public-key cryptography(SAKA) between two previously unknown parties, which provides stronger security assurances for SIP Authentication and media stream, and it is provably secure in the CK security model. Due to using certificateless public key cryptography, SAKA effectively avoids the requirement of a large Public Key Infrastructure and conquers the key escrow problem in previous schemes.