Subject: RFC 2617 erratum on DIGEST auth

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 02 Mar 2012 09:57:32 -0700

Dear HTTP folks,

I'd appreciate guidance regarding the processing of Erratum #1649, filed
against RFC 2617 over three years ago. In accordance with
http://www.ietf.org/iesg/statement/errata-processing.html do people
think this is a valid erratum, or is further discussion needed?

###

Errata ID: 1649

Status: Reported
Type: Technical

Reported By: Ganga Mahesh Siddem
Date Reported: 2009-01-08
Edited by: Alexey Melnikov
Date Edited: 2010-07-07

Section 5 says:

 /* calculate H(A1) as per spec */
      void DigestCalcHA1(
          IN char * pszAlg,
          IN char * pszUserName,
          IN char * pszRealm,
          IN char * pszPassword,
          IN char * pszNonce,
          IN char * pszCNonce,
          OUT HASHHEX SessionKey
          )
      {
            MD5_CTX Md5Ctx;
            HASH HA1;

            MD5Init(&Md5Ctx);
            MD5Update(&Md5Ctx, pszUserName, strlen(pszUserName));
            MD5Update(&Md5Ctx, ":", 1);
            MD5Update(&Md5Ctx, pszRealm, strlen(pszRealm));
            MD5Update(&Md5Ctx, ":", 1);
            MD5Update(&Md5Ctx, pszPassword, strlen(pszPassword));
            MD5Final(HA1, &Md5Ctx);
            if (stricmp(pszAlg, "md5-sess") == 0) {
                  MD5Init(&Md5Ctx);
|                 MD5Update(&Md5Ctx, HA1, HASHLEN);
                  MD5Update(&Md5Ctx, ":", 1);
                  MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
                  MD5Update(&Md5Ctx, ":", 1);
                  MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
                  MD5Final(HA1, &Md5Ctx);
            };
            CvtHex(HA1, SessionKey);
      };

It should say:

 /* calculate H(A1) as per spec */
      void DigestCalcHA1(
          IN char * pszAlg,
          IN char * pszUserName,
          IN char * pszRealm,
          IN char * pszPassword,
          IN char * pszNonce,
          IN char * pszCNonce,
          OUT HASHHEX SessionKey
          )
      {
            MD5_CTX Md5Ctx;
            HASH HA1;
|           HASHHEX HA1Hex;

            MD5Init(&Md5Ctx);
            MD5Update(&Md5Ctx, pszUserName, strlen(pszUserName));
            MD5Update(&Md5Ctx, ":", 1);
            MD5Update(&Md5Ctx, pszRealm, strlen(pszRealm));
            MD5Update(&Md5Ctx, ":", 1);
            MD5Update(&Md5Ctx, pszPassword, strlen(pszPassword));
            MD5Final(HA1, &Md5Ctx);
            if (stricmp(pszAlg, "md5-sess") == 0) {
|                 CvtHex(HA1, HA1Hex);
                  MD5Init(&Md5Ctx);
|                 MD5Update(&Md5Ctx, HA1Hex, HASHHEXLEN);
                  MD5Update(&Md5Ctx, ":", 1);
                  MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
                  MD5Update(&Md5Ctx, ":", 1);
                  MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
                  MD5Final(HA1, &Md5Ctx);
            };
            CvtHex(HA1, SessionKey);
      };

Notes:

DigestCalcHA1 sample implemention has to be corrected.

###

Thanks!

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Henrik Nordström <[email-masked]>
Date: Fri, 02 Mar 2012 21:09:32 +0100

> think this is a valid erratum, or is further discussion needed?

It's valid.

All MD5 hashes in Digest is in their hex-ascii representation form
(3.1.3). So

         H(data) = MD5(data)

MD5-sess    A1  = H( unq(username-value) ":" unq(realm-value)
                     ":" passwd )
                     ":" unq(nonce-value) ":" unq(cnonce-value)

Gives that the initial hashed part is the 32-character hex MD5 hash
H( unq(username-value) ":" unq(realm-value) ":" passwd )

Note that the example is in general very poor at demonstrating MD5-sess
usage and I would expect many to get the cnonce wrong from looking at
this example code. The code looks innocently capable of MD5-sess when it
in fact is only showing normal MD5 usage. And it does not help that the
code calculates H(A1) directly where the text describing the difference
beteen MD5 and MD5-sess is only looking at A1.

Regards
Henrik

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 06 Mar 2012 12:34:43 -0700

>> think this is a valid erratum, or is further discussion needed?

Thanks for checking.

> beteen MD5 and MD5-sess is only looking at A1.

Yes, there are lots of interoperability problems with DIGEST auth, and
the seemingly poor documentation in RFC 2617 (and, separately, RFC 2831
for SASL) certainly doesn't help.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/