Building a CHAP Login System: Encrypting Data in the Client
Web developers concerned with the security of their applications face one of their worst fears every time someone logs in: the possibility that passwords will be passed in plain text. Fortunately, there is a way to avoid this security risk. In this article, the first of three parts, Alejandro Gervasio helps you tackle this problem with a Challenge Handshake Authentication Protocol login system.
Building a CHAP Login System: Encrypting Data in the Client - The basics of a CHAP login system: pros and cons of client-side data encryption (Page 2 of 4 )
Before I start writing some sample code, a few key concepts on CHAP login systems should be properly explained. Obviously, the main benefit of such a system is that the password is never transmitted to the server in plain text, in this way reducing the chances for a hacker to catch it with a sniffing program.
However, there is a drawback that you should be aware of. Many login forms poorly implement CHAP systems, by simply transmitting the MD5 hash of the password without appending onto it a challenge string (usually a random value that the server sends to the client), which may lead to a potentially dangerous situation. Even when the password is encrypted with a MD5 hash, there is still the possibility of an interception. A hacker could sniff out the hash of the password instead of sniffing the password itself, and use it to gain access to the system, thus encrypting only the password quickly breaks down the methodís effectiveness.
According to the above deployed concepts, for a CHAP login system to be reasonably effective, the MD5 hash of the password together with the challenge value combined should always be transmitted to the server. Otherwise, as I explained before, the login system might be a lot more vulnerable to hacker exploits.
As you can see, there are some key concepts to evaluate before you start setting up a CHAP login system, in order to provide users with an acceptable level of security when they log into your web application. Considering what I explained previously, it is important to make sure your login forms are still functional even if users are accessing your site with browsers where scripting has been turned off.
Having pointed out the advantages and drawbacks of using CHAP in your web programs, now you can turn your attention to the practical aspect of the topic, by taking a look at an illustrative example, which is designed to implement basically the above deployed concepts. So, letís move on and study the sample code.