Re: RFC 2617 erratum on DIGEST auth

fre 2012-03-02 klockan 09:57 -0700 skrev Peter Saint-Andre:
> Dear HTTP folks,
> 
> I'd appreciate guidance regarding the processing of Erratum #1649, filed
> against RFC 2617 over three years ago. In accordance with
> http://www.ietf.org/iesg/statement/errata-processing.html do people
> think this is a valid erratum, or is further discussion needed?

It's valid.

All MD5 hashes in Digest is in their hex-ascii representation form
(3.1.3). So

         H(data) = MD5(data)

MD5-sess    A1  = H( unq(username-value) ":" unq(realm-value)
                     ":" passwd )
                     ":" unq(nonce-value) ":" unq(cnonce-value)

Gives that the initial hashed part is the 32-character hex MD5 hash
H( unq(username-value) ":" unq(realm-value) ":" passwd )

Note that the example is in general very poor at demonstrating MD5-sess
usage and I would expect many to get the cnonce wrong from looking at
this example code. The code looks innocently capable of MD5-sess when it
in fact is only showing normal MD5 usage. And it does not help that the
code calculates H(A1) directly where the text describing the difference
beteen MD5 and MD5-sess is only looking at A1.

Regards
Henrik

Received on Friday, 2 March 2012 20:10:12 UTC