view release on metacpan or  search on metacpan

Basic.pm  view on Meta::CPAN

#
# Authen::Challenge::Basic: Provides a trivial challenge/response protocol
#	to assist in authentication tasks. It provides for time-window
#	challenge/response sessions. 
#
# Using this module, it's possible to autenticate both endpoints of
# a transaction provided that a shared-secret was exchanged prior to
# the session among the endpoints. As timestamps are part of the
# protocol, some restrictions can be applied to the timing, to help
# prevent hijacked connections.
#
# This is free software. You can use at will provided that proper
# credit is given to the author(s). This module requires MD5.
#
# lem@cantv.net, 19980713 - Initial release
#
#############

Basic.pm  view on Meta::CPAN

The built-in random number generator from perl is used in this module.
Hooks for better random number generators are planned soon to increase
the relative strength of this protocol. In any case, the main security
dependencies for this module are MD5 itself and the secrecy of the shared
secret.

The following functions are provided by this class.

new()

Creates a new instance of a challenge/response endpoint. It has three
parameters that influence its behavior. Those can be seen next

	$server = Authen::Challenge::Basic->new ('Secret' => 'known2us',
						 'Timeout' => 30,
						 'Sync' => 10);

'Secret' is used to indicate the shared secret to use in this session.

'Timeout' specifies the lifespan, in seconds, for this transaction.
This means that a succesful Validate() must occur within this many

README  view on Meta::CPAN

Basic Challenge-Response authentication

This is a perl5 module implementing basic MD5-based challenge/response.
The authentication method provided, allows for mutual authentications
of the endpoints of a communication channel provided that a shared
secret known only to them has been exchanged prior to the session.

If the secret is known to a third party, this authentication mechanism
is useless (ie, this situation can lead to a man-in-the-middle-attack)
so its secrecy is very important.

Note that this module does NOT provide security agains eavesdropping or
hijacking. A positive identification can be followed by an attacker
stealing the connection or sniffing. Both situations can be detrimental
to the security.