VL09 Concurrency in Algorithms

Agenda

CRAM-MD5 is a challenge-response authentication mechanism based on the MD5 algorithm.

The CRAM-MD5 protocol involves a single challenge request and response, and is initiated by the server. The authentication looks roughly like this:

Challenge: The server sends a random string to the client.
Response: The client responds with a string created as follows.
- The challenge is hashed using a hash function, with a shared secret (typically, the password, or a hash thereof) as the secret key.
- The result is sent back to the server.
Comparison: The server repeats the same process to compute the expected response. If the given response and the expected response match, then authentication was successful.

Client	Server
user would like to log in
	generate a random challenge string "randomABC" and send it
input → "mypassword123"
hashed_input = MD5(input) → 9c87baa223f464954940f859bcf2e233
hashed_input += "randomABC"
final_hash = MD5(hashed_input)
send user name and final_hash to the server
	Server looks up the password hash for the user
	The same computation is performed
	final_hash from client and server are compared