base

2026-08-07 17:38:18 +09:00
commit 873193a243
9613 changed files with 2755992 additions and 0 deletions
@@ -0,0 +1,29 @@
+Secure User authentication using HMAC and SKID2
+
+In some cases it may be usefull to provide secure authentication
+without the need of an encryption layer. We'll now discuss how to
+implement the protocol SKID2 using the mhash HMAC functions.
+
+Ok let's now assume we're on the server side and we want to authenticate
+a client using username-password but without transmitting the password
+in the clear.
+
+Step 1. The server sends a random string (over 8 bytes) to the client
+        Let's call it RANDOM1. 
+        We send client RANDOM1.
+        
+Step 2. The client reads RANDOM1 and gets 
+        the username and password from the user. 
+        The client now calculates
+        X = HMAC( password, RANDOM1+RANDOM2). 
+        RANDOM2 is a random string generated by the client. Client sends 
+        the server X, USERNAME, RANDOM2.
+
+Step 3. The server now has the values: RANDOM1, RANDOM2, USERNAME, X.
+	    a. Checks the users database for USERNAME and retrieves the
+	       user's password (PASSWORD).
+	    b. Checks if HMAC( PASSWORD, RANDOM1+RANDOM2) == X
+	       If it is not the same abort.
+
+
+Now we have the user authenticated.