Digest access authentication

HTTP
Persistence Compression HTTPS
Request methods
OPTIONS GET HEAD POST PUT DELETE TRACE CONNECT PATCH
Header fields
Cookie ETag Location HTTP referer DNT X-Forwarded-For
Status codes
301 Moved permanently 302 Found 303 See Other 403 Forbidden 404 Not Found
v t e

Digest access authentication is one of the agreed-upon methods a web server can use to negotiate credentials with a user's web browser. It applies a hash function to a password before sending it over the network, which is safer than basic access authentication, which sends plaintext.

Technically, digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol.

Overview [edit]

Digest access authentication was originally specified by RFC 2069 (An Extension to HTTP: Digest Access Authentication). RFC 2069 specifies roughly a traditional digest authentication scheme with security maintained by a server-generated nonce value. The authentication response is formed as follows (where HA1, HA2, A1, A2 are names of string variables):

$\mathrm{HA1} = \mathrm{MD5}\Big(\mathrm{A1}\Big) = \mathrm{MD5}\Big( \mathrm{username} : \mathrm{realm} : \mathrm{password} \Big)$

$\mathrm{HA2} = \mathrm{MD5}\Big(\mathrm{A2}\Big) = \mathrm{MD5}\Big( \mathrm{method} : \mathrm{digestURI} \Big)$

$\mathrm{response} = \mathrm{MD5}\Big( \mathrm{HA1} : \mathrm{nonce} : \mathrm{HA2} \Big)$

RFC 2069 was later replaced by RFC 2617 (HTTP Authentication: Basic and Digest Access Authentication). RFC 2617 introduced a number of optional security enhancements to digest authentication; "quality of protection" (qop), nonce counter incremented by client, and a client-generated random nonce. These enhancements are designed to protect against, for example, chosen-plaintext attack cryptanalysis.

If the algorithm directive's value is "MD5" or unspecified, then HA1 is

$\mathrm{HA1} = \mathrm{MD5}\Big(\mathrm{A1}\Big) = \mathrm{MD5}\Big( \mathrm{username} : \mathrm{realm} : \mathrm{password} \Big)$

If the algorithm directive's value is "MD5-sess", then HA1 is

$\mathrm{HA1} = \mathrm{MD5}\Big(\mathrm{A1}\Big) = \mathrm{MD5}\Big(\mathrm{MD5}\Big( \mathrm{username} : \mathrm{realm} : \mathrm{password} \Big) : \mathrm{nonce} : \mathrm{cnonce} \Big)$

If the qop directive's value is "auth" or is unspecified, then HA2 is

$\mathrm{HA2} = \mathrm{MD5}\Big(\mathrm{A2}\Big) = \mathrm{MD5}\Big( \mathrm{method} : \mathrm{digestURI} \Big)$

If the qop directive's value is "auth-int", then HA2 is

$\mathrm{HA2} = \mathrm{MD5}\Big(\mathrm{A2}\Big) = \mathrm{MD5}\Big( \mathrm{method} : \mathrm{digestURI} : \mathrm {MD5}(entityBody)\Big)$

If the qop directive's value is "auth" or "auth-int", then compute the response as follows:

$\mathrm{response} = \mathrm{MD5}\Big( \mathrm{HA1} : \mathrm{nonce} : \mathrm{nonceCount} : \mathrm{clientNonce} : \mathrm{qop} : \mathrm{HA2} \Big)$

If the qop directive is unspecified, then compute the response as follows:

$\mathrm{response} = \mathrm{MD5}\Big( \mathrm{HA1} : \mathrm{nonce} : \mathrm{HA2} \Big)$

The above shows that when qop is not specified, the simpler RFC 2069 standard is followed.

Impact of MD5 security on digest authentication [edit]

The MD5 calculations used in HTTP digest authentication is intended to be "one way", meaning that it should be difficult to determine the original input when only the output is known. If the password itself is too simple, however, then it may be possible to test all possible inputs and find a matching output (a brute-force attack) – perhaps aided by a dictionary or suitable look-up list.

The HTTP scheme was designed by Phillip Hallam-Baker at CERN in 1993 and does not incorporate subsequent improvements in authentication systems, such as the development of keyed-hash message authentication code (HMAC). Although the cryptographic construction that is used is based on the MD5 hash function, collision attacks were in 2004 generally believed to not affect applications where the plaintext (i.e. password) is not known. However, claims in 2006 cause some doubt over other MD5 applications as well. So far, however, MD5 collision attacks have not been shown to pose a threat to digest authentication, and the RFC 2617 allows servers to implement mechanisms to detect some collision and replay attacks.

HTTP digest authentication considerations [edit]

Advantages [edit]

HTTP digest authentication is designed to be more secure than traditional digest authentication schemes; e.g., "significantly stronger than (e.g.) CRAM-MD5 ..." (RFC 2617).

Some of the security strengths of HTTP digest authentication are:

The password is not used directly in the digest, but rather HA1 = MD5(username:realm:password). This allows some implementations (e.g. JBoss) to store HA1 rather than the cleartext password.
Client nonce was introduced in RFC 2617, which allows the client to prevent Chosen-plaintext attacks (which otherwise makes e.g. rainbow tables a threat to digest authentication schemes).
Server nonce is allowed to contain timestamps. Therefore the server may inspect nonce attributes submitted by clients, to prevent replay attacks.
Server is also allowed to maintain a list of recently issued or used server nonce values to prevent reuse.

Disadvantages [edit]

Digest access authentication is intended as a security trade-off. It is intended to replace unencrypted HTTP basic access authentication. It is not, however, intended to replace strong authentication protocols, such as public-key or Kerberos authentication.

In terms of security, there are several drawbacks with digest access authentication:

Many of the security options in RFC 2617 are optional. If quality-of-protection (qop) is not specified by the server, the client will operate in a security-reduced legacy RFC 2069 mode.
Digest access authentication is vulnerable to a man-in-the-middle (MitM) attack. For example, a MitM attacker could tell clients to use basic access authentication or legacy RFC2069 digest access authentication mode. To extend this further, digest access authentication provides no mechanism for clients to verify the server's identity.
Some servers require passwords to be stored using reversible encryption. However, it is possible to instead store the digested value of the username, realm, and password.
It prevents the use of a strong password hash (such as bcrypt) when storing passwords (since either the password, or the digested username, realm and password must be recoverable).

Alternative authentication protocols [edit]

Some strong authentication protocols for web-based applications include:

Public key authentication (usually implemented with HTTPS / SSL client certificates).
Kerberos or SPNEGO authentication, primarily employed by Microsoft IIS running configured for Integrated Windows Authentication (IWA).
Secure Remote Password protocol (preferably within the HTTPS / TLS layer).

Weak cleartext protocols are also often in use:

These weak cleartext protocols used together with HTTPS network encryption resolve many of the threats that digest access authentication is designed to prevent.

Example with explanation [edit]

The following example was originally given in RFC 2617 and is expanded here to show the full text expected for each request and response. Note that only the "auth" (authentication) quality of protection code is covered – at the time of writing, only the Opera and Konqueror web browsers are known to support "auth-int" (authentication with integrity protection). Although the specification mentions HTTP version 1.1, the scheme can be successfully added to a version 1.0 server, as shown here.

This typical transaction consists of the following steps.

The client asks for a page that requires authentication but does not provide a username and password. Typically this is because the user simply entered the address or followed a link to the page.
The server responds with the 401 "Unauthorized" response code, providing the authentication realm and a randomly-generated, single-use value called a nonce.
At this point, the browser will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a username and password. The user may decide to cancel at this point.
Once a username and password have been supplied, the client re-sends the same request but adds an authentication header that includes the response code.
In this example, the server accepts the authentication and the page is returned. If the username is invalid and/or the password is incorrect, the server might return the "401" response code and the client would prompt the user again.

Note: A client may already have the required username and password without needing to prompt the user, e.g. if they have previously been stored by a web browser.

Client request (no authentication)

GET /dir/index.html HTTP/1.0
Host: localhost

(followed by a new line, in the form of a carriage return followed by a line feed).

Server response

HTTP/1.0 401 Unauthorized
Server: HTTPd/0.9
Date: Sun, 10 Apr 2005 20:26:47 GMT
WWW-Authenticate: Digest realm="testrealm@host.com",
                        qop="auth,auth-int",
                        nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                        opaque="5ccc069c403ebaf9f0171e9517f40e41"
Content-Type: text/html
Content-Length: 311

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<HTML>
  <HEAD>
    <TITLE>Error</TITLE>
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1">
  </HEAD>
  <BODY><H1>401 Unauthorized.</H1></BODY>
</HTML>

Client request (username "Mufasa", password "Circle Of Life")

GET /dir/index.html HTTP/1.0
Host: localhost
Authorization: Digest username="Mufasa",
                     realm="testrealm@host.com",
                     nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                     uri="/dir/index.html",
                     qop=auth,
                     nc=00000001,
                     cnonce="0a4f113b",
                     response="6629fae49393a05397450978507c4ef1",
                     opaque="5ccc069c403ebaf9f0171e9517f40e41"

(followed by a blank line, as before).

Server response

HTTP/1.0 200 OK
Server: HTTPd/0.9
Date: Sun, 10 Apr 2005 20:27:03 GMT
Content-Type: text/html
Content-Length: 7984

(followed by a blank line and HTML text of the restricted page).

The "response" value is calculated in three steps, as follows. Where values are combined, they are delimited by colon symbols.

The MD5 hash of the combined username, authentication realm and password is calculated. The result is referred to as HA1.
The MD5 hash of the combined method and digest URI is calculated, e.g. of "GET" and "/dir/index.html". The result is referred to as HA2.
The MD5 hash of the combined HA1 result, server nonce (nonce), request counter (nc), client nonce (cnonce), quality of protection code (qop) and HA2 result is calculated. The result is the "response" value provided by the client.

Since the server has the same information as the client, the response can be checked by performing the same calculation. In the example given above the result is formed as follows, where MD5() represents a function used to calculate an MD5 hash, backslashes represent a continuation and the quotes shown are not used in the calculation.

Completing the example given in RFC 2617 gives the following results for each step.

   HA1 = MD5( "Mufasa:testrealm@host.com:Circle Of Life" )
       = 939e7578ed9e3c518a452acee763bce9

   HA2 = MD5( "GET:/dir/index.html" )
       = 39aff3a2bab6126f332b942af96d3366

   Response = MD5( "939e7578ed9e3c518a452acee763bce9:\
                    dcd98b7102dd2f0e8b11d0f600bfb0c093:\
                    00000001:0a4f113b:auth:\
                    39aff3a2bab6126f332b942af96d3366" )
            = 6629fae49393a05397450978507c4ef1

At this point the client may make another request, reusing the server nonce value (the server only issues a new nonce for each "401" response) but providing a new client nonce (cnonce). For subsequent requests, the hexadecimal request counter (nc) must be greater than the last value it used – otherwise an attacker could simply "replay" an old request with the same credentials. It is up to the server to ensure that the counter increases for each of the nonce values that it has issued, rejecting any bad requests appropriately. Obviously changing the method, URI and/or counter value will result in a different response value.

The server should remember nonce values that it has recently generated. It may also remember when each nonce value was issued, expiring them after a certain amount of time. If an expired value is used, the server should respond with the "401" status code and add stale=TRUE to the authentication header, indicating that the client should re-send with the new nonce provided, without prompting the user for another username and password.

The server does not need to keep any expired nonce values – it can simply assume that any unrecognised values have expired. It is also possible for the server to only allow each nonce value to be returned once, although this forces the client to repeat every request. Note that expiring a server nonce immediately will not work, as the client would never get a chance to use it.

SIP digest authentication [edit]

SIP uses basically the same digest authentication algorithm. It is specified by RFC 3261.

Browser implementation [edit]

Most browsers have substantially implemented the spec, some barring certain features such as auth-int checking or the MD5-sess algorithm. If the server requires that these optional features be handled, clients may not be able to authenticate (though note mod_auth_digest for Apache does not fully implement RFC 2617 either).

Amaya
Gecko-based: (not including auth-int)
iCab 3.0.3+
KHTML- and WebKit-based: (not including auth-int)
- iCab 4
- Konqueror
- Google Chrome
- Safari
Tasman-based:
- Internet Explorer for Mac
Trident-based:
- Internet Explorer 7+ (not including auth-int)
Presto-based:
- Opera
- Opera Mobile
- Opera Mini
- Nintendo DS Browser
- Nokia 770 Browser
- Sony Mylo 1's Browser
- Wii Internet Channel Browser

References [edit]

"Hash Collision Q&A". Cryptography Research. 2005-02-16. Archived from the original on 2010-03-06. Retrieved 2013-01-05. NOTE: Specific information not given; needs quote from exact version of this page originally cited.
Jongsung Kim, Alex Biryukov, Bart Preneel, Seokhie Hong. "On the Security of HMAC and NMAC Based on HAVAL, MD4, MD5, SHA-0 and SHA-1". IACR.
Scott Stark (2005-10-08). "DIGEST Authentication (4.0.4+)". JBoss.
"HTTP Authentication: Basic and Digest Access Authentication: Storing passwords". IETF. June 1999.
Tim Berners-Lee, Roy Fielding, Henrik Frystyk Nielsen (1996-02-19). "Hypertext Transfer Protocol -- HTTP/1.0: Request". W3C.
Emanuel Corthay (2002-09-16). "Bug 168942 - Digest authentication with integrity protection". Mozilla.
Timothy D. Morgan (2010-01-05). "HTTP Digest Integrity: Another look, in light of recent attacks". vsecurity.com.
"Apache Module mod_auth_digest". Apache HTTP Server documentation. December 2012.

External links [edit]

RFC 2617
RFC 2069 (obsolete)

Popular search requests

Digest access authentication is an object of interest for many people. For example, the people often search for Digest access authentication website, Digest access authentication blog, Digest access authentication online, Digest access authentication information, Digest access authentication photo, Digest access authentication picture, Digest access authentication video, Digest access authentication movie, Digest access authentication history, Digest access authentication news, Digest access authentication facts, Digest access authentication description, Digest access authentication detailed info, Digest access authentication features, Digest access authentication manual, Digest access authentication instructions, Digest access authentication comparison, Digest access authentication book, Digest access authentication story, Digest access authentication article, Digest access authentication review, Digest access authentication feedbacks, Digest access authentication selection, Digest access authentication data, Digest access authentication address, Digest access authentication phone number, download Digest access authentication, Digest access authentication reference, Digest access authentication wikipedia, Digest access authentication facebook, Digest access authentication twitter, Digest access authentication 2013, Digest access authentication 2014, Digest access authentication in the United States, Digest access authentication USA, Digest access authentication US, Digest access authentication in United Kingdom, Digest access authentication UK, Digest access authentication in Canada, Digest access authentication in Australia, etc.

Digest access authentication is also an object of commercial interest. For example, many people are interested in Digest access authentication offers, Digest access authentication buy, Digest access authentication sell, Digest access authentication sale, Digest access authentication discounts, discounted Digest access authentication, Digest access authentication coupon, Digest access authentication promo code, Digest access authentication order, to order Digest access authentication online, to buy Digest access authentication, how much for Digest access authentication, Digest access authentication price, Digest access authentication cost, Digest access authentication price list, Digest access authentication tariffs, Digest access authentication rates, Digest access authentication prices, Digest access authentication delivery, Digest access authentication store, Digest access authentication online store, Digest access authentication online shop, inexpensive Digest access authentication, cheap Digest access authentication, Digest access authentication for free, free Digest access authentication, used Digest access authentication, and so on.

Information source: wikipedia.org

Do you want to know more? Look at the full version of the Digest access authentication article.