RFC 7616 Quiz

Q1: Digest authentication aims to avoid sending

Multiple Choice

A. Any headers at all B. The password in clear form C. The HTTP status code

**Explanation:** **Correct (B):** Digest uses a challenge response style computation instead of raw password transmission

Q2: Which response header carries a Digest challenge

Multiple Choice

A. WWW-Authenticate B. Authorization C. Forwarded

**Explanation:** **Correct (A):** The server challenges with WWW-Authenticate, the client responds with Authorization

Q3: In Digest, a nonce is primarily used to

Multiple Choice

A. Compress headers B. Replace TLS key exchange C. Make the response depend on a fresh server challenge

**Explanation:** **Terms:** replay resistance **Correct (C):** The server can rotate or validate nonces to limit replay

Q4: Why is Digest authentication considered tricky in practice (select all)

Multi-Select

A. It has many parameters and edge cases B. Servers may need access to password equivalent material C. It still benefits from TLS for confidentiality and integrity D. It automatically blocks all phishing attacks

**Explanation:** **Correct (A,B,C):** Implementation complexity and credential handling can be burdensome **Options:** - D (incorrect): It does not solve phishing **Related:** Modern deployments often use token based schemes over TLS

Q5: What is the parameter name for the server challenge value in Digest (one word)

Short Text

**Explanation:** **Correct:** nonce

Q6: A correct statement about Digest and TLS is

Multiple Choice

A. Digest makes TLS unnecessary B. TLS is still valuable because it protects the whole exchange C. TLS breaks Digest by changing headers

**Explanation:** **Correct (B):** Digest does not provide channel integrity or protect metadata from passive observers

HTTP Digest Authentication

References (URLs)

Q1: Digest authentication aims to avoid sending

Q2: Which response header carries a Digest challenge

Q3: In Digest, a nonce is primarily used to

Q4: Why is Digest authentication considered tricky in practice (select all)

Q5: What is the parameter name for the server challenge value in Digest (one word)

Q6: A correct statement about Digest and TLS is