Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the difference between HTTP Digest Authentication and HTTPS basic authentication from a performance and security point of view?

share|improve this question

closed as off-topic by ThatGraemeGuy, mdpc, dawud, Tom O'Connor Aug 25 '13 at 22:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – dawud, Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

    
have you done any research on this yourself? –  Drew Khoury Aug 21 '13 at 6:57
    
yes, about performance: avg response time in https w/ basic - 1s, http w/ digest 0.7s, but it server response waiting time - not auth time –  qwert_ukg Aug 21 '13 at 7:34
1  
I suggest you look harder, and outline in your question all the things you've tried. stackoverflow.com/questions/599048/… –  Drew Khoury Aug 21 '13 at 7:37
add comment

1 Answer 1

up vote 2 down vote accepted

From a performance perspective, https requires that everything be encrypted: Request, Response, and credentials.
This is, of necessity, more server overhead (CPU/time, RAM) than HTTP Digest Authentication, which simply hashes the AUTH credentials so they can't be easily intercepted/stolen.

So all other things being equal, https + Basic Auth will be slower than http + Digest Auth.
How much slower? Probably not any amount you're going to notice, beyond the initial connection and SSL handshake.


The remainder of this answer is completely stolen from the top answer on This Stack Overflow Question covering the exact same material.

The pros and cons of HTTP Digest Authentication are explained quite clearly in the Wikipedia article on the topic -- you should read that!

To put it bluntly: HTTP Digest Auth will only protect you from losing your cleartext password to an attacker (and considering the state of MD5 security, maybe not even that).

It is however wide open to Man-in-the-Middle attacks and also -- depending on the implementation, since most of the advanced features are optional -- replay, dictionary and other forms of attacks.

However, the biggest difference between an HTTPS connection and an HTTP connection protected by Digest Auth is that with the former everything is encrypted with Public Key Encryption, while with the latter content is sent in the clear.

As for the performance: from the above mentioned points it should be quite clear that you get what you pay for (with CPU cycles).

For "flexibility" I'll go with: huh?

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.