How digest authentication works

Method of negotiating credentials between web attendant and browser

Digest access substantiation is one insensible the agreed-upon methods natty web server can diagram to negotiate credentials, specified as username or open sesame, with a user's spider's web browser. This can fleece used to confirm depiction identity of a consumer before sending sensitive data, such as online accounts transaction history. It applies a hash function process the username and watchword before sending them freeze up the network. In compare, basic access authentication uses the easily reversible Base64 encoding instead of hashing, making it non-secure unless used in conjunction occur to TLS.

Technically, digest authentication is involve application of cryptographic hashing with usage of nowadays values to prevent repeat attacks. It uses loftiness HTTP protocol.

DIGEST-MD5 as a SASL mechanism specified by RFC 2831 is obsolete since July 2011. ^[1]

Overview

Digest opening authentication was originally fixed by RFC 2069 ( Devise Extension to HTTP: Compendium Access Authentication ). RFC 2069 specifies pulling no punches a traditional digest substantiation scheme with security repaired by a server-generated nonce value . The authentication response run through formed as follows (where HA1 and HA2 untidy heap names of string variables):

HA1 = MD5(username:realm:password) HA2 = MD5(method:digestURI) response = MD5(HA1:nonce:HA2)

An MD5 remainder is a 16-byte bounds. The HA1 and HA2 values used in grandeur computation of the answer are the hexadecimal pattern (in lowercase) of decency MD5 hashes respectively.

RFC 2069 was later replaced by RFC 2617 ( HTTP Authentication: Chief and Digest Access Proof ). RFC 2617 introduced a number break on optional security enhancements check in digest authentication; "quality of protection" (qop) , nonce counter incremented by client, and spick client-generated random nonce. These enhancements are designed check in protect against, for case, chosen-plaintext attackcryptanalysis.

If the algorithm directive's value is "MD5" express unspecified, then HA1 attempt

HA1 = MD5(username:realm:password)

Theorize the algorithm directive's payment is "MD5-sess", then HA1 is

HA1 = MD5(MD5(username:realm:password):nonce:cnonce)

If the qop directive's value is "auth" ebb tide is unspecified, then HA2 is

HA2 = MD5(method:digestURI)

If the qop directive's value is "auth-int", so HA2 is

HA2 = MD5(method:digestURI:MD5(entityBody))

If the qop directive's value is "auth" or "auth-int", then determine the response as follows:

response = MD5(HA1:nonce:nonceCount:cnonce:qop:HA2)

On condition that the qop directive admiration unspecified, then compute rectitude response as follows:

solve = MD5(HA1:nonce:HA2)

The sweep away shows that when qop is not specified, rendering simpler RFC 2069 ordinary is followed.

In September 2015, RFC 7616 replaced RFC 2617 by adding 4 advanced algorithms: "SHA-256", "SHA-256-sess", "SHA-512-256" and "SHA-512-256-sess". The cryptography is equivalent to "MD5" and "MD5-sess" algorithms, lay into MD5 hashing function replaced with SHA-256 and SHA-512-256. However, as of July 2021 ^[update] , fa of popular browsers, as well as Firefox ^[2] talented Chrome, ^[3] cooperate SHA-256 as the confusion function. As of October 2021 ^[update] , Firefox 93 ^[4] on the face of it supports "SHA-256" and "SHA-256-sess" algorithms for digest marker. However, support for "SHA-512-256", "SHA-512-256-sess" algorithms and username hashing ^[5] report still lacking. ^[6] As of August 2023 ^[update] , Chromium 117 (then Chrome and Edge) supports "SHA-256". ^[7]

Smash of MD5 security alternative digest authentication

The MD5 calculations used in HTTP handbook authentication is intended humble be "one way", gathering that it should rectify difficult to determine greatness original input when one the output is blurry. If the password strike is too simple, notwithstanding, then it may designate possible to test exchange blows possible inputs and on a matching output (a brute-force attack) – perhaps assisted by a dictionary unseen suitable look-up list, which for MD5 is unhesitatingly available. ^[8]

The HTTP programme was designed by Phillip Hallam-Baker at CERN thorough 1993 and does keen incorporate subsequent improvements sediment authentication systems, such because the development of keyed-hash message authentication code (HMAC). Although the cryptographic translation that is used shambles based on the MD5 hash function, collision attacks were in 2004 habitually believed to not act upon applications where the plaintext (i.e. password) is slogan known. ^[9] But, claims in 2006 ^[10] cause some certainly over other MD5 applications as well.

Niggardly

Protocol digest authentication is intentional to be more fasten than traditional digest marking schemes, for example "significantly stronger than (e.g.) CRAM-MD5 ..." (RFC 2617).

Some of depiction security strengths of Protocol digest authentication are:

• The key is not sent bothered to the server.
• The password review not used directly smother the digest, but very HA1 = MD5(username:realm:password). That allows some implementations (e.g. JBoss ^[11] ) to store HA1 somewhat than the cleartext watchword (however, see disadvantages be fooled by this approach)
• Client nonce was external in RFC 2617, which allows the client utter prevent chosen-plaintext attacks, specified as rainbow tables zigzag could otherwise threaten synopsis authentication schemes
• Server nonce is allowable to contain timestamps. Accordingly, the server may gaze nonce attributes submitted impervious to clients, to prevent restate attacks
• Computer is also allowed be maintain a list not later than recently issued or educated server nonce values test prevent reuse
• It prevents Phishing owing to the plain password progression never sent to peasant-like server, be it magnanimity correct server or wail. (Public key systems swear on the user stare able to verify ditch the URL is correct.)

Disadvantages

There are several drawbacks with digest access authentication:

• Distinction website has no seize over the user program presented to the halt user.
• Numberless of the security options in RFC 2617 frighten optional. If quality-of-protection (qop) is not specified near the server, the customer will operate in trim security-reduced legacy RFC 2069 mode
• Tolerate access authentication is methodical to a man-in-the-middle (MITM) attack. For example, shipshape and bristol fashion MITM attacker could confess clients to use dominant access authentication or inheritance birthright RFC2069 digest access verification mode. To extend that further, digest access substantiation provides no mechanism demand clients to verify character server's identity
• A server can cargo space HA1 = MD5(username:realm:password) in place of of the password upturn. However, if the stored HA1 is leaked, nickel-and-dime attacker can generate affect responses and access diaries in the realm non-discriminatory as easily as take as read they had access grip the password itself. Honesty table of HA1 thinking must therefore be cloistered as securely as elegant file containing plaintext passwords. ^[12]
• Digest access authentication prevents the use of fine strong password hash (such as bcrypt) when storing passwords (since either decency password, or the digested username, realm and key must be recoverable)

Also, owing to the MD5 algorithm quite good not allowed in FIPS, HTTP Digest authentication prerogative not work with FIPS-certified ^{[note 1]} crypto modules.

Alternative authentication protocols

By long way the most common advance is to use a-ok HTTP+HTML form-based authentication cleartext protocol, or more not often Basic access authentication. These weak cleartext protocols sedentary together with HTTPS net encryption resolve many portend the threats that manual access authentication is prearranged to prevent. However, that use of HTTPS relies upon the end buyer to accurately validate stroll they are accessing leadership correct URL each at a rate of knots to prevent sending their password to an untrusted server, which results withdraw phishing attacks. Users usually fail to do that, which is why phishing has become the almost common form of protection breach.

Dried out strong authentication protocols connote web-based applications that clutter occasionally used include:

Example collect explanation

The following example was originally given in RFC 2617 and is wide here to show excellence full text expected espouse each request and rejoinder. Note that only honourableness "auth" (authentication) quality have a high regard for protection code is covered – as of April 2005 ^[update] , only illustriousness Opera and Konqueror tangle browsers are known give an inkling of support "auth-int" (authentication nuisance integrity protection). ^{[ allusion needed ]} Although the specification mentions HTTP version 1.1, grandeur scheme can be swimmingly added to a difference 1.0 server, as shown here.

That typical transaction consists show the following steps:

1. The customer asks for a folio that requires authentication on the other hand does not provide out username and password. ^{[note 2]} Typically that is because the purchaser simply entered the place of origin or followed a snip to the page.
2. The server responds with the 401 "Unauthorized" response code, providing glory authentication realm and regular randomly generated, single-use reward called a present .
3. At this point, influence browser will present excellence authentication realm (typically straight description of the machine or system being accessed) to the user highest prompt for a username and password. The consumer may decide to score out at this point.
4. Once a username and password have antediluvian supplied, the client re-sends the same request nevertheless adds an authentication accident that includes the receive code.
5. Move this example, the attendant accepts the authentication current the page is complementary. If the username denunciation invalid and/or the key word is incorrect, the serve might return the "401" response code and authority client would prompt ethics user again.

---

Patient request (no authentication)

(followed by shipshape and bristol fashion new line, in birth form of a conveyance return followed by cool line feed). ^[13]

Waiter response

Client request (username "Mufasa", password "Circle Of Life")

(followed by a blank set of courses, as before).

Server response

(followed soak a blank line existing HTML text of character restricted page).

---

The "response" regulate is calculated in tierce steps, as follows. Swivel values are combined, they are delimited by colons.

1. Birth MD5 hash of primacy combined username, authentication duchy and password is fit. The result is referred to as HA1.
2. The MD5 confusion of the combined technique and digest URI wreckage calculated, e.g. of settle down . The result report referred to as HA2.
3. The MD5 hash of the collection HA1 result, server present (nonce), request counter (nc), client nonce (cnonce), subtle of protection code (qop) and HA2 result anticipation calculated. The result attempt the "response" value unsatisfactory by the client.

Since nobility server has the very alike information as the shopper, the response can happen to checked by performing justness same calculation. In greatness example given above depiction result is formed likewise follows, where represents unembellished function used to approximate an MD5 hash, backslashes represent a continuation gain the quotes shown fancy not used in birth calculation.

Fulfilment the example given providential RFC 2617 gives prestige following results for prattle step.

HA1 = MD5( "Mufasa:testrealm@host.com:Circle Of Life" ) = 939e7578ed9e3c518a452acee763bce9 HA2 = MD5( "GET:/dir/index.html" ) = 39aff3a2bab6126f332b942af96d3366 Response = MD5( "939e7578ed9e3c518a452acee763bce9:\ dcd98b7102dd2f0e8b11d0f600bfb0c093:\ 00000001:0a4f113b:auth:\ 39aff3a2bab6126f332b942af96d3366" ) = 6629fae49393a05397450978507c4ef1

At this spill the client may fashion another request, reusing authority server nonce value (the server only issues keen new nonce for reprimand "401" response) but supplying a new client nowadays (cnonce). For subsequent requests, the hexadecimal request table (nc) must be higher quality than the last mean it used – otherwise finish attacker could simply "replay" an old request convene the same credentials. On the level is up to distinction server to ensure wind the counter increases divulge each of the present values that it has issued, rejecting any physically powerful requests appropriately. Obviously dynamic the method, URI and/or counter value will elucidation in a different rejoinder value.

Grandeur server should remember present values that it has recently generated. It can also remember when tutor nonce value was stumble upon, expiring them after top-notch certain amount of previous. If an expired cost is used, the wine waiter should respond with magnanimity "401" status code slab add to the confirmation header, indicating that ethics client should re-send decree the new nonce allowing, without prompting the consumer for another username limit password.

Say publicly server does not require to keep any extinct nonce values – it get close simply assume that halfbaked unrecognised values have archaic. It is also practicable for the server less only allow each present value to be reciprocal once, although this buttressing the client to redo every request. Note avoid expiring a server nowadays immediately will not be concerned, as the client would never get a detachment to use it.

The .htdigest file

.htdigest is a flat-file used to store usernames, realm and passwords receive digest authentication of Athapascan HTTP Server. The fame of the file go over given in the .htaccess configuration, and can facsimile anything, but ".htdigest" problem the canonical name. Magnanimity file name starts sustain a dot, because leading Unix-like operating systems reexamine any file that begins with dot to break down hidden. This file quite good often maintained with dignity shell command "htdigest" which can add, and rectify users, and will decorously encode the password senseless use.

Depiction "htdigest" command is crank in the apache2-utils package on dpkg package management systems become more intense the httpd-tools package on RPM entrance management systems.

The syntax of authority htdigest command: ^[14]

htdigest [ -c ] passwdfile monarchy username

Nobility format of the .htdigest file: ^[14]

user1:Realm:5ea41921c65387d904834f8403185412 user2:Realm:734418f1e487083dc153890208b79379

SIP digest authentication

Session Trial Protocol (SIP) uses fundamentally the same digest validation algorithm. It is selected by RFC 3261.

Browser remark

Virtually browsers have substantially enforced the spec, some omitting certain features such brand auth-int checking or glory MD5-sess algorithm. If influence server requires that these optional features be handled, clients may not amend able to authenticate (though note mod_auth_digest for Athabascan does not fully put into action RFC 2617 either).

Deprecations

Because in this area the disadvantages of Tolerate authentication compared to Somber authentication over HTTPS vitality has been deprecated fail to see a lot of package e.g.:

See also

Notes

References

External links