[Freeciv-Dev] Re: MD5 password authentication and so on.

[Vasco Alexandre Da Silva Costa <vasc@xxxxxxxxxxxxxx>]

On Wed, 22 Aug 2001, Zverina, David wrote:

> You are missing challenge-response mechanism.
> Works something like this.
> 1. Client sends a login request with user id
> 2. Server sends a challenge string which changes every time it's used (eg. a
> timestamp)
> 3. Client encrypts the challenge string using his password as the key. It
> sends the resultant string to the server.
> 4. Server does the same calculation as the client using it's copy of the
> password and compares it to the password received. If they match the client
> is authenticated.

Yes. I like this solution better.

---
Vasco Alexandre da Silva Costa @ Instituto Superior Tecnico, Lisboa