Subject: Re: [http-auth] HTTP Digest - A1 with Salted Hash

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 1 Apr 2015 08:23:16 -0400

For the *transition period*, where the system wants to support both salted
and non-salted clients, the server could store both the salted password and
the non-salted password.

Regards,
 Rifaat

On Tue, Mar 31, 2015 at 3:54 PM, Yoav Nir <[email-masked]> wrote:

> The difference is that to use a salted hash, you need a salted database.
> Once the database is salted, you can't use plain digest. This means that
> your server cannot support both old and new clients. It's either a salted
> database and new clients, or an unsalted database and both kinds of
> clients, but no salt. There is no smooth transition.
>
> Yoav
>
> On Mar 31, 2015, at 9:27 PM, Rifaat Shekh-Yusef <[email-masked]>
> wrote:
>
> Yoav,
>
> To take advantage of any of the new functionalities defined in this draft
> you need new software in the client and the server.
> How is salted hash any different?
>
> Regards,
>  Rifaat
>
>
> On Mon, Mar 30, 2015 at 1:15 PM, Yoav Nir <[email-masked]> wrote:
>
>>
>> > On Mar 30, 2015, at 6:01 PM, Rifaat Shekh-Yusef <[email-masked]>
>> wrote:
>> >
>> > Yoav,
>> >
>> > This would be addressed by indicating that the algorithms in the
>> registry might have a salted variant, similar to the -sess variant.
>> > Existing clients will always select non-salted variants, while new
>> clients should be able to select salted variants if they support it.
>>
>> Sure, but -sess variants have been there since forever. "-salt" would
>> require a new client and a new server, and a server can't support both
>> "-salt" and non-"-salt" (because if the database is salted, you can do
>> Basic, but you can't do regular Digest).
>>
>> So if the database requires a new client and new software on the server,
>> we might as well choose something more modern than Digest.
>>
>> Yoav
>>
>>
>>
>
>

---

From: Yoav Nir <[email-masked]>
Date: Wed, 1 Apr 2015 16:03:09 +0300

Or, they could keep two versions of the database, one that works with the old Digest, and another that works with MutualAuth.

I just don’t see the advantage in having a slight improvement to Digest that requires as much effort and disruption as rolling out a more modern authentication scheme.

Yoav

> On Apr 1, 2015, at 3:23 PM, Rifaat Shekh-Yusef <[email-masked]> wrote:
> 
> For the *transition period*, where the system wants to support both salted and non-salted clients, the server could store both the salted password and the non-salted password.
> 
> Regards,
>  Rifaat
> 
> 
> 
> On Tue, Mar 31, 2015 at 3:54 PM, Yoav Nir <[email-masked] <mailto:[email-masked]>> wrote:
> The difference is that to use a salted hash, you need a salted database. Once the database is salted, you can’t use plain digest. This means that your server cannot support both old and new clients. It’s either a salted database and new clients, or an unsalted database and both kinds of clients, but no salt. There is no smooth transition.
> 
> Yoav
> 
>> On Mar 31, 2015, at 9:27 PM, Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Yoav,
>> 
>> To take advantage of any of the new functionalities defined in this draft you need new software in the client and the server.
>> On Mon, Mar 30, 2015 at 1:15 PM, Yoav Nir <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> > On Mar 30, 2015, at 6:01 PM, Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]>> wrote:
>> >
>> > Yoav,
>> >
>> > This would be addressed by indicating that the algorithms in the registry might have a salted variant, similar to the -sess variant.
>> > Existing clients will always select non-salted variants, while new clients should be able to select salted variants if they support it.
>> 
>> Sure, but -sess variants have been there since forever. “-salt” would require a new client and a new server, and a server can’t support both “-salt” and non-“-salt” (because if the database is salted, you can do Basic, but you can’t do regular Digest).
>> 
>> So if the database requires a new client and new software on the server, we might as well choose something more modern than Digest.
>> 
>> Yoav
>> 
>> 
>> 
> 
>