Is it possible to define the input password string as plaintext or hash?

Question

I have a RESTful API containing a URI / UserService / Register. / UserService / Register accepts an XML request, for example:

<UserRegistrationRequest>
  <Password>password</Password>
  <Profile>
    <User>
      <UserName>username</UserName>
    </User>
  </Profile>
</UserRegistrationRequest>

I have the following questions above:

• Is there a way (using C # and .Net 3.5+) to force / verify that clients calling Register are passing a hashed password, not plaintext? Is the choice of the hashing algorithm that the client will use is a good idea?

• We could provide a second URI / UserService / ComputePasswordHash, which the client called before calling / UserService / Register. This ensures that each password is hashed using the same algorithm. Is there a mechanism in REST for a client to call one URI before calling another?

I hope I explained myself.

.

Answer 1

REST , . , , , .

- (SSL/https)

Answer 2

- . , : , . ( ), sting ( ), :

, ? , ?

:

• , Base64, , , byte, , , , -.
• - ComputePasswordHash, Register

Answer 3

. SSL , api .NET framework.

GetPublicKey(), , . , . , . RSA alogs . 1024bit.

UPDATE: , this msdn