Jan Vicherek wrote:
>
> what is the strength of encryption of Basic Authorization ? What
> cipher does it use to encrypt it ? I presume that it combines the
> realm,username and password info, right ?
>
Null, the string is the base64 encoding of userid:password, it's
cleartext.
From draft-ietf-http-authentication-01.txt:
[...]
To receive authorization, the client sends the userid and password,
separated by a single colon (":") character, within a base64 [7]encoded
string in the credentials.
basic-credentials = "Basic" SP base64-user-pass
base64-user-pass = <base64 [4] encoding of user-pass,
except not limited to 76 char/line>
user-pass = userid ":" password
userid = *<TEXT excluding ":">
password = *TEXT
[...]
Stefano Ravaioli