Professional Microsoft IIS 8

Configuring Digest Authentication

When Digest authentication is enabled, users are prompted to supply a username and password, similar to Basic authentication. Although the user's username is returned in cleartext to the server, the user's password is not, making Digest authentication significantly more secure than Basic authentication.

Digest authentication was defined in RFC 2069 and updated in RFC 2619. Digest authentication is supported by all major browsers. Like Basic authentication, Digest authentication works through proxy servers and firewalls and can thus be used in most Internet-facing scenarios.

Digest authentication uses hashing algorithms (MD5 in all the cases seen by the authors) to secure the user's password. A hashing algorithm is a mathematical process that is easy to compute, but, given the hash of a value, difficult (or impossible) to determine the original value. For example, when using the mathematical functions Sine and Cosine, a value is easy to compute, but deducing the original value is impossible because, for every given value of Sin(x), there are an infinite number of starting possible values when attempting to perform the inverse function.

In order to validate the user's identity, the server must also have an MD5 hash of the user's password. The local Security Accounts Manager (SAM) database has no facility for storing the MD5 hash of a user's password; thus, Digest authentication cannot be used for local accounts. In a Windows 2000 (or Mixed Mode) ...