cens/ohmageServer — Issue #234: challenge response authentication
Author: jeroenooms
Created: 2012-03-10 00:05:06+00:00
State: open

Passwords should preferably not go over the line, but be used to create one-time signatures. We could do some kind of challenge response scheme, which is a 2 step procedure. Below an example proposal:

First there client requests the server to generate a new token. The server generates a random token, but the token is not valid yet for anything. E.g:

user/auth_token_new

returns an token 2fce98c0-6a42-11e1-b0c4-0800200c9a66. The token has to be validated before it can be used. To validate, the user needs to use his username and password. However, we do not actually send the password. Instead the user needs to send the md5 hash that is a result of appending the password to the token. I.e. in this case if my password is 'padthai', I would calulcate md5(2fce98c0-6a42-11e1-b0c4-0800200c9a66padthai). Hence, in the second step, the client would do:

user/auth_validate?username=ohmage.jeroen&token=2fce98c0-6a42-11e1-b0c4-0800200c9a66&sign=27b2e8cbb6d63b7f51183e9825178af3

Or alternatively send the token as a cookie header as we are already supporting, and only passing the 'username' and 'sign' parameter. The server will then test if this token was indeed generated by the server in the last 10 minutes, and if the md5 hash is correct.

The reason why this is better is that if a third party or man in the middle were to sniff the conversation, they won't be able to use this information to re-authenticate later on. The sign is only valid for this specific token, which will never be re-issued.