Subject: New revision of DIGEST-MD5 (draft-melnikov-rfc2831bis-00.txt) is available

From: Alexey Melnikov <[email-masked]>
Date: Thu, 18 Apr 2002 23:30:36 +0100

I've submitted a new revision of DIGEST-MD5 document. I didn't fix all
items from the list of issues I have, but I've decided to submit a new
document in a hope to start some discussions.

Fixed in this revision (I should probably add this to the document
itself):

1). Fixed several typos:

>   Kcc = MD5({H(A1)[0..n],
>   "Digest H(A1) to client-to-server sealing key magic constant"})

Changed "[0..n]" to "[0..n-1]".

>   The key for confidentiality protecting messages from server to
client
>   is:

>   Kcs = MD5({H(A1)[0..n],
>   "Digest H(A1) to server-to-client sealing key magic constant"})

Changed "[0..n]" to "[0..n-1]".

>   where MD5 is as specified in [RFC 1321]. For cipher "rc4-40" n is 5;

>   for "rc4-56" n is 7; for the rest n is 16. The key for the "rc-*"

Typo "rc4-*"

>   ciphers is all 16 bytes of Kcc or Kcs; the key for "des" is the
first
>   7 bytes; the key for "3des" is the first 14 bytes. The IV for "des"
>   and "3des" is the last 8 bytes of Kcc or Kcs.

2). Tightened the syntax of the nonce and cnonce to prohibit quoted
characters:
    nonce-value = *qdtext
    cnonce-value = *qdtext

They use to be "qdstr-val". RFC 2617 (HTTP Digest) prohibits <">, we are
prohibiting even more!
I've also changed qdtext from:

   qdtext         = <any TEXT except <">>

to

   qdtext         = <any TEXT except <">, "\">

i.e. <\> is not allowed unquoted. Is it Ok with everybody?

3). DES and 3DES are mandatory to implement for privacy layer. I've
removed DES, as it seems too weak now, especially when used together
with CBC mode (see Questions below). Objections?

4). Section 2.1.2, description of nc-value: shouldn't it be the server
aborting the exchange?

Changed:
This directive may appear at most once; if multiple instances are
present,
the client should abort the authentication exchange.

to:
This directive is required and MUST be present exactly once; otherwise,
authentication fails.

Reason: text below says that "server verifies nonce-count". It can't
verify
nonce-count if the client didn't include it.

Alternative: say if nonce-count is missing it is defaulted to
"00000001".

5). Added text saying that authentication/authorization ids and
passwords are in Unicode Normalization form KC without NULs.

6). Clarified that the unquoted versions of  username, realm, etc. used
in A1 calculations.

7). Added UTF-8 to References section and removed some unused
references.

To Do:

1). Security considerations: How does DIGEST-MD5 protect against
downgrade of maxbuf, qop, qop-options?

2). Add acknowledgment section.

3). More ABNF cleanup.

Other questions:

1). realm-value, authzid-value - always in UTF8 even if charset=utf-8 is
absent?

2). Specify that realm is in Unicode Normalization form KC encoded as
UTF-8?

3). Can we move to Draft without fixing the issue with "CBC mode attack"
discussed in Minneapolis at TLS and SSH WGs meetings.
TLS working group has the same issue and they seem to think that they
can't move to Draft without fixing.

Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Richmond, Surrey, UK
Phone: +44 20 8332 4508

I speak for myself only, not for my employer.
__________________________________________