Maybe I didn't understood your question, but most chances that you don't need to implement anything related to cryptography here, there is a possibility to limit access to web-pages, by using client certificate authentication.
Configuration I tried myself was an intranet site on IIS with SSL certificate issued by corporate CA. The site was configured to receive only SSL connections and require client certificate. The trusts where configured, so that web server beleived only to certificates issued by specific corporate CA.
From software point of view: 2 licenses on Win2k server, one for CA, second for IIS.
Main Topics
Browse All Topics
by: judhiPosted on 2003-06-09 at 08:03:15ID: 8682479
If you really want to implement digital signature for web based authentication, it is not straight forward as compared to password authentication. Probably it will take one whole day to write the answer here.
But just to give you some headups, the client's PC must be installed with encryption/decryption software based on the private key. The private key itself also must be on that same machine.
The server needs to have the public key of the user.
The scenario looks like this:
1) user send username to server
2) server lookup the user's public key based on the username and send a challenge number to the user (say: "1234"), this number is encrypted using that user's public key.
3) user receive the encrypted challenge number and decrypt it using his private key.
4) user send the challenge number back to the server, but this number is encrypted using server's public key.
5) server will decrypt the number just sent by user using its private key
6) if the server found that the decrypted number is the same like what it sent previously ("1234"), it means that the user is genuine because he has the correct private key so he can decrypt that number.
Hope this helps.
Judhi