Subject: Re: [http-auth] HTTP Digest - HMAC & Salted Hash

From: "Gonzalo Salgueiro (gsalguei)" <[email-masked]>
Date: Wed, 6 May 2015 02:44:28 +0000

Hi Rifaat - 

Thanks for raising this issue.  This is of particular importance to the STUNbis effort going on in the TRAM WG, so I am very interested in seeing this work progress.  I’ll actively support the work and, if needed, would also be willing to co-author.

Thanks,

Gonzalo

> Hi,
> 
> During the Gen-Art and SecDir reviews of the HTTP Digest draft, HMAC support was suggested by both reviewers.
> Also, the STUNbis team asked to add support for salted hash.
> Based on the discussion with the ADs it was decided that, if there is interest, that these two issues be addressed in a separate draft.
> 
> 
> Here is an initial proposal for adding HMAC and salted hash support that I would like to discuss:
> 
> 
> Definitions
> -----------
> 
> H(data) = Hash(data)
> KD(secret, data) = HMAC-Hash(secret, data)
> 
> 
> A1 Calculation
> --------------
> 
> If the solution is able to provide only system wide salt, then:
> A1 = username:realm:password:salt
> 
> If the solution is able to provide a per user salt, then:
> A1 = password:realm:salt
> 
> 
> Example
> -------
> 
> Using HMAC-SHA256 and per user salt calculation:
> 
> A1 = password:realm:salt
> H(A1) = SHA256(password:realm:salt)
> Response = KD( H(A1), nonce:nc:cnonce:qop:H(A2) ) = HMAC-SHA256( H(A1), nonce:nc:cnonce:qop:H(A2) )
> 
> 
> Is there any objection to starting a new document to define HMAC and salted hash support?
> Any thoughts about the proposal above?
> 
> Thanks,
>  Rifaat

---

From: Simon Perreault <[email-masked]>
Date: Wed, 6 May 2015 12:24:35 -0400

Le 2015-05-05 10:44 PM, "Gonzalo Salgueiro (gsalguei)" <[email-masked]>
a écrit :
> Thanks for raising this issue.  This is of particular importance to the
STUNbis effort going on in the TRAM WG, so I am very interested in seeing
this work progress.  I’ll actively support the work and, if needed, would
also be willing to co-author.

Same for me!

Simon