Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-digest-07.txt

From: Gary Mort <[email-masked]>
Date: Mon, 12 May 2014 15:14:35 -0400

The documentation for A1 has consistently led to some confusion in implementations.

"
3.4.2 A1
    If the "algorithm" parameter's value is "<algorithm>", e.g. "SHA-
    256", then A1 is:

         A1       = unq(username) ":" unq(realm) ":" passwd
       where
          passwd   = < user's password >

    If the "algorithm" parameter's value is "<algorithm>-sess", e.g.
    "SHA-256-sess", then A1 is calculated only once - on the first
    request by the client following receipt of a WWW-Authenticate
    challenge from the server.  It uses the server nonce from that
    challenge, and the first client nonce value to construct A1 as
    follows:

          A1       = H( unq(username) ":" unq(realm)
                         ":" passwd )
                         ":" unq(nonce) ":" unq(cnonce)
"

For either case, A1 can be calculated only once.  IE since
  unq(username) ":" unq(realm) ":" passwd
  is fixed for the life of the session, there is no requirement for the client and server to calculate it upon each submission.

Moreover, whether the client is free to calculate A1 only once OR it can calculate A1 for each packet - it just needs to ensure to always use the initial nonce and cnonce if it recalculates the hash.

Just as a start, I would rephrase as:
3.4.2 A1

    If the "algorithm" parameter's value is "<algorithm>", e.g. "SHA-
    256", then A1 is:

          A1       = unq(username) ":" unq(realm) ":" passwd

       where

          passwd   = < user's password >

    If the "algorithm" parameter's value is "<algorithm>-sess", e.g.
    "SHA-256-sess", then A1 is calculated using the initial nonce and
    cnounce value from the firstrequest by the client following receipt
    of a WWW-Authenticate challenge from the server.  It uses the server
    nonce from that challenge, herin called nonce-prime, and the first
    client nonce value to construct A1, herin called cnonce-prime as
    follows:

          A1       = H( unq(username) ":" unq(realm)
                         ":" passwd )
                         ":" unq(nonce-prime) ":" unq(cnonce-prime)

    This creates a 'session key' for the authentication of subsequent
    requests and responses which is different for each "authentication
    session", thus limiting the amount of material hashed with any one
    key.  (Note: see further discussion of the authentication session in
    section 3.6.) Because the server need only use the hash of the user
    credentials in order to create the A1 value, this construction could
    be used in conjunction with a third party authentication service so
    that the web server would not need the actual password value.  The
    specification of such a protocol is beyond the scope of this
    specification.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 13 May 2014 09:01:55 -0400

I am fine with your proposed change.
If I do not hear any objection, I will make the change in the next version
of the draft.

Regards,
 Rifaat

On Mon, May 12, 2014 at 3:14 PM, Gary Mort <[email-masked]> wrote:

> Just as a start, I would rephrase as:3.4.2 A1
>