- From: John C. Mallery <jcma@ai.mit.edu>
- Date: Sun, 8 Sep 1996 23:59:04 -0400
- To: Larry Masinter <masinter@parc.xerox.com>
- Cc: http-wg%cuckoo.hpl.hp.com@hplb.hpl.hp.com
My main complaint about digest authentication is that it should not just authenticate the user but also authenticate the entire http transaction. The current specification is vulnerable to man in the middle attacks. This can be fixed by adding the following two items: 1. a digest header on the server responses that hashes the request, the secret etc with the response code. 2. digest headers whenever an entity is transfered in this mode so we know we're really getting the right bits. These digest headers need to incorporate a surrogate for the transaction ID into the hash to protect against short-window replay attacks. These changes give a big payoff: authenticated transactions with exportable technology. I'm surprised this was not already included in the digest draft, as it is a rather glaring omission once one gets base64 authentication off the brain.
Received on Tuesday, 10 September 1996 03:41:15 UTC