Subject: [http-auth] HTTP Digest Access Authentication Algorithm Update

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Fri, 31 Aug 2012 09:46:12 -0400

Hello,

The Digest mechanism, widely used in SIP networks, is based on the HTTP Digest mechanism defined in RFC 2617.

The HTTP Digest mechanism states that MD5 is the algorithm to be used, and while it allows other algorithms to be added (per the 'token' defined in Section 3.2.1, algorithm = "algorithm" "=" ( "MD5" | "MD5-sess" | token )), no other algorithm is specified.

In 2008 the US-CERT issued a note that MD5 "should be considered cryptographically broken and unsuitable for further use". The following draft is an attempt to specify extensions to the HTTP Digest Access Authentication scheme by adding support for the SHA1 and SHA2 suite of hash algorithms.

https://datatracker.ietf.org/doc/draft-ahrens-httpbis-digest-auth-update/?include_text=1

Our initial goal was to address the issue for SIP, but when we discussed this topic offline with Mark Nottingham (HTTPbis chair) and Tobias Gondrom (WebSec co-chair), they suggested to us to submit it in the context of HTTPbis to allow the group to consider HTTP Digest as one of the mechanisms for HTTP 2.0.

We would really appreciate it if people can review the draft and provide us with their feedback on the following:

1. The basic idea of extending RFC2617 to support other algorithms.

2. Including the extended HTTP Digest mechanism in HTTP 2.0.

Regards,

Rifaat