CRAM-MD5
CRAM-MD5 ( C hallenge- R esponse A uthentication M echanism, M essage D Igest 5 ) is an authentication method according to the challenge-response principle on the basis of MD5 - HMAC algorithm.
It is often used for authentication against SMTP or IMAP servers , for example , as it avoids the transmission of the password in clear text. This method enables secure authentication to a server via unencrypted channels.
Procedure
The procedure is described in more detail in RFC 2195 :
- The server sends a character string (numbers, time stamp and fully qualified host name of the server) to the client ( challenge ).
- The client replies with a string of user names, spaces and a "digest". This digest is the Base64 encoded MD5 hash of a value calculated from the challenge and password ( response ).
- The server can check the received digest by performing the same calculation and comparing the result with that received from the client.
With a clever implementation ( RFC 2104 ), the server does not have to save the password in clear text.
Taking into account the time stamp from the server when calculating the password hash prevents attackers from accessing the direct authentication features of a user via insecure connections. If the user's password were only hashed, an attacker only needed to access this hash and could use it to authenticate himself to a server at will. Even if the time stamp that the server has sent to the client is known, an attacker can no longer do this because the time stamp from the server changes with every authentication process, but the attacker does not have the password to hash it, including the time stamp, and himself to be able to send to the server. There is only the possibility of accessing the time stamp of the server and the digest of the client generated from it and of using various cryptographic attacks, brute force , dictionary attack , rainbow table etc., based on the hash and time stamp to infer the clear text password . Since these are very complex processes, CRAM-MD5 can certainly be considered sufficiently secure.