Subject: Escaping <\> in HTTP Digest (RFC 2617)

From: Alexey Melnikov <[email-masked]>
Date: Sat, 17 Mar 2007 21:43:55 +0000

Hi,
I would like to get some feedback on what HTTP Digest implementations do
with '\' in username/realm/password. For example, if I have a username
'example.com\user1', do implementations hash 'example.com\\user1' (i.e.
the \ is escaped with another \), or just 'example.com\user1' (single
slash).

Thanks,
Alexey

---

From: Henrik Nordstrom <[email-masked]>
Date: Tue, 20 Mar 2007 12:15:33 +0100

> the \ is escaped with another \), or just 'example.com\user1' (single

The implementation in Squid takes the RFC literal and just removes the
quotes, hashing the escaped string as-is.

2617 3.2.1 definition of algorithm

     The
     notation unq(X) means the value of the quoted-string X without the
     surrounding quotes.

2616 2.2 definition of quoted-string

       quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
       qdtext         = <any TEXT except <">>
       quoted-pair    = "\" CHAR

Which reminds me... the above definition isn't good..

Regards
Henrik

---

From: Henrik Nordstrom <[email-masked]>
Date: Tue, 20 Mar 2007 12:30:42 +0100

> Which reminds me... the above definition isn't good..

And if the memory is awake it's one of the open issues to add that \
must be escaped..

Regards
Henrik

---

From: Eric Lawrence <[email-masked]>
Date: Fri, 23 Mar 2007 11:59:52 -0700

IE7 uses WDigest.dll, which escapes the \ into \\.
IE6 and previous versions relied on Digest.dll, which did not escape the \.

Thanks,

Eric Lawrence
Program Manager
Internet Explorer Networking

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alexey Melnikov
Sent: Saturday, March 17, 2007 2:44 PM
To: [email-masked]
Subject: Escaping <\> in HTTP Digest (RFC 2617)

Hi,

Thanks,
Alexey

---

From: Eric Lawrence <[email-masked]>
Date: Fri, 23 Mar 2007 13:24:38 -0700

I should clarify that IE removes the escaping before calculating the hash for each directive value.

Hence IE6 and IE7 behavior are the same in this regard, we still hash "redmond\ericlaw" when username is sent as "redmond\\ericlaw".

-Eric

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eric Lawrence
Sent: Friday, March 23, 2007 12:00 PM
To: Alexey Melnikov; [email-masked]
Subject: RE: Escaping <\> in HTTP Digest (RFC 2617)

Thanks,

Eric Lawrence
Program Manager

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alexey Melnikov
Sent: Saturday, March 17, 2007 2:44 PM
To: [email-masked]
Subject: Escaping <\> in HTTP Digest (RFC 2617)

Hi,

Thanks,
Alexey

---

From: Scott Lawrence <[email-masked]>
Date: Fri, 23 Mar 2007 23:34:05 +0100

> IE6 and previous versions relied on Digest.dll, which did not escape the \.

Why does it do that?  The spec doesn't say anything about escaping
inputs to the hash...

---

From: Henrik Nordstrom <[email-masked]>
Date: Sun, 25 Mar 2007 23:47:05 +0200

> Why does it do that?  The spec doesn't say anything about escaping

Well.. it both does and doesn't.. the specs says

      A1       = unq(username-value) ":" unq(realm-value) ":" passwd

     The

       username-value   = quoted-string

There is two ambiguities in the above:

a) that \ isn't excluded in qdtext requiring it to be quoted (\\). Most
likely a bug in the specs as not escaping \ makes it impossible to
unquote the string in a meaningful manner with \ being the escape
character and valid in front of any other character (only needed infront
of " and \, but valid infront of any). There is an open rfc2616bis issue
for this problem.

b) the unq(X) definition, which only says to remove the surrounding
quotes not the \ escapes..  Most likely a bug in the specs however and
it should mean the unquoted value (both surrounding quotes and escapes
removed).

So imho in the sensible reading of the specs the hash should be
calculated on the unquoted username-value with both surrounding quotes
and \ escapes removed. And any username-value encoded in the protocol
should have \ escaped. Unfortunately it's not entirely clear on either
point..

Regards
Henrik

---

From: Henrik Nordstrom <[email-masked]>
Date: Sun, 25 Mar 2007 23:51:07 +0200

> Hence IE6 and IE7 behavior are the same in this regard, we still hash "redmond\ericlaw" when username is sent as "redmond\\ericlaw".

If I understand this correctly a server which wishes to interoperate
with IE6 need to be careful in how it dequotes the username-value, and
only remove \ infront of " or \

Regards
Henrik