4.5 Replay Attacks
A replay attack against Digest authentication would usually be
pointless for a simple GET request since an eavesdropper would
already have seen the only document he could obtain with a replay.
This is because the URI of the requested document is digested in the
client request and the server will only deliver that document. By
contrast under Basic Authentication once the eavesdropper has the
user's password, any document protected by that password is open to
him.
Thus, for some purposes, it is necessary to protect against replay
attacks. A good Digest implementation can do this in various ways.
The server created "nonce" value is implementation dependent, but if
it contains a digest of the client IP, a time-stamp, the resource
ETag, and a private server key (as recommended above) then a replay
attack is not simple. An attacker must convince the server that the
request is coming from a false IP address and must cause the server
to deliver the document to an IP address different from the address
to which it believes it is sending the document. An attack can only
succeed in the period before the time-stamp expires. Digesting the
client IP and time-stamp in the nonce permits an implementation which
does not maintain state between transactions.
For applications where no possibility of replay attack can be
tolerated the server can use one-time nonce values which will not be
honored for a second use. This requires the overhead of the server
remembering which nonce values have been used until the nonce time-
stamp (and hence the digest built with it) has expired, but it
effectively protects against replay attacks.
An implementation must give special attention to the possibility of
replay attacks with POST and PUT requests. Unless the server employs
one-time or otherwise limited-use nonces and/or insists on the use of
the integrity protection of qop=auth-int, an attacker could replay
valid credentials from a successful request with counterfeit form
data or other message body. Even with the use of integrity protection
most metadata in header fields is not protected. Proper nonce
generation and checking provides some protection against replay of
previously used valid credentials, but see 4.8.
4.6 Weakness Created by Multiple Authentication Schemes
An HTTP/1.1 server may return multiple challenges with a 401
(Authenticate) response, and each challenge may use a different
auth-scheme. A user agent MUST choose to use the strongest auth-
scheme it understands and request credentials from the user based
upon that challenge.
Note that many browsers will only recognize Basic and will require
that it be the first auth-scheme presented. Servers should only
include Basic if it is minimally acceptable.
When the server offers choices of authentication schemes using the
WWW-Authenticate header, the strength of the resulting authentication
is only as good as that of the of the weakest of the authentication
schemes. See section 4.8 below for discussion of particular attack
scenarios that exploit multiple authentication schemes.
4.7 Online dictionary attacks
If the attacker can eavesdrop, then it can test any overheard
nonce/response pairs against a list of common words. Such a list is
usually much smaller than the total number of possible passwords. The
cost of computing the response for each password on the list is paid
once for each challenge.
The server can mitigate this attack by not allowing users to select
passwords that are in a dictionary.
4.8 Man in the Middle
Both Basic and Digest authentication are vulnerable to "man in the
middle" (MITM) attacks, for example, from a hostile or compromised
proxy. Clearly, this would present all the problems of eavesdropping.
But it also offers some additional opportunities to the attacker.
A possible man-in-the-middle attack would be to add a weak
authentication scheme to the set of choices, hoping that the client
will use one that exposes the user's credentials (e.g. password). For
this reason, the client should always use the strongest scheme that
it understands from the choices offered.
An even better MITM attack would be to remove all offered choices,
replacing them with a challenge that requests only Basic
authentication, then uses the cleartext credentials from the Basic
authentication to authenticate to the origin server using the
stronger scheme it requested. A particularly insidious way to mount
such a MITM attack would be to offer a "free" proxy caching service
to gullible users.
User agents should consider measures such as presenting a visual
indication at the time of the credentials request of what
authentication scheme is to be used, or remembering the strongest
authentication scheme ever requested by a server and produce a
warning message before using a weaker one. It might also be a good
idea for the user agent to be configured to demand Digest
authentication in general, or from specific sites.
Or, a hostile proxy might spoof the client into making a request the
attacker wanted rather than one the client wanted. Of course, this is
still much harder than a comparable attack against Basic
Authentication.
4.9 Chosen plaintext attacks
With Digest authentication, a MITM or a malicious server can
arbitrarily choose the nonce that the client will use to compute the
response. This is called a "chosen plaintext" attack. The ability to
choose the nonce is known to make cryptanalysis much easier [8].
However, no way to analyze the MD5 one-way function used by Digest
using chosen plaintext is currently known.
The countermeasure against this attack is for clients to be
configured to require the use of the optional "cnonce" directive;
this allows the client to vary the input to the hash in a way not
chosen by the attacker.
4.10 Precomputed dictionary attacks
With Digest authentication, if the attacker can execute a chosen
plaintext attack, the attacker can precompute the response for many
common words to a nonce of its choice, and store a dictionary of
(response, password) pairs. Such precomputation can often be done in
parallel on many machines. It can then use the chosen plaintext
attack to acquire a response corresponding to that challenge, and
just look up the password in the dictionary. Even if most passwords
are not in the dictionary, some might be. Since the attacker gets to
pick the challenge, the cost of computing the response for each
password on the list can be amortized over finding many passwords. A
dictionary with 100 million password/response pairs would take about
3.2 gigabytes of disk storage.
The countermeasure against this attack is to for clients to be
configured to require the use of the optional "cnonce" directive.
4.11 Batch brute force attacks
With Digest authentication, a MITM can execute a chosen plaintext
attack, and can gather responses from many users to the same nonce.
It can then find all the passwords within any subset of password
space that would generate one of the nonce/response pairs in a single
pass over that space. It also reduces the time to find the first
password by a factor equal to the number of nonce/response pairs
gathered. This search of the password space can often be done in
parallel on many machines, and even a single machine can search large
subsets of the password space very quickly -- reports exist of
searching all passwords with six or fewer letters in a few hours.
The countermeasure against this attack is to for clients to be
configured to require the use of the optional "cnonce" directive.
4.12 Spoofing by Counterfeit Servers
Basic Authentication is vulnerable to spoofing by counterfeit
servers. If a user can be led to believe that she is connecting to a
host containing information protected by a password she knows, when
in fact she is connecting to a hostile server, then the hostile
server can request a password, store it away for later use, and feign
an error. This type of attack is more difficult with Digest
Authentication -- but the client must know to demand that Digest
authentication be used, perhaps using some of the techniques
described above to counter "man-in-the-middle" attacks. Again, the
user can be helped in detecting this attack by a visual indication of
the authentication mechanism in use with appropriate guidance in
interpreting the implications of each scheme.
4.13 Storing passwords
Digest authentication requires that the authenticating agent (usually
the server) store some data derived from the user's name and password
in a "password file" associated with a given realm. Normally this
might contain pairs consisting of username and H(A1), where H(A1) is
the digested value of the username, realm, and password as described
above.
The security implications of this are that if this password file is
compromised, then an attacker gains immediate access to documents on
the server using this realm. Unlike, say a standard UNIX password
file, this information need not be decrypted in order to access
documents in the server realm associated with this file. On the other
hand, decryption, or more likely a brute force attack, would be
necessary to obtain the user's password. This is the reason that the
realm is part of the digested data stored in the password file. It
means that if one Digest authentication password file is compromised,
it does not automatically compromise others with the same username
and password (though it does expose them to brute force attack).
There are two important security consequences of this. First the
password file must be protected as if it contained unencrypted
passwords, because for the purpose of accessing documents in its
realm, it effectively does.
A second consequence of this is that the realm string should be
unique among all realms which any single user is likely to use. In
particular a realm string should include the name of the host doing
the authentication. The inability of the client to authenticate the
server is a weakness of Digest Authentication.
4.14 Summary
By modern cryptographic standards Digest Authentication is weak. But
for a large range of purposes it is valuable as a replacement for
Basic Authentication. It remedies some, but not all, weaknesses of
Basic Authentication. Its strength may vary depending on the
implementation. In particular the structure of the nonce (which is
dependent on the server implementation) may affect the ease of
mounting a replay attack. A range of server options is appropriate
since, for example, some implementations may be willing to accept the
server overhead of one-time nonces or digests to eliminate the
possibility of replay. Others may satisfied with a nonce like the one
recommended above restricted to a single IP address and a single ETag
or with a limited lifetime.
The bottom line is that *any* compliant implementation will be
relatively weak by cryptographic standards, but *any* compliant
implementation will be far superior to Basic Authentication.
5 Sample implementation
The following code implements the calculations of H(A1), H(A2),
request-digest and response-digest, and a test program which computes
the values used in the example of section 3.5. It uses the MD5
implementation from RFC1321.
File "digcalc.h":
#define HASHLEN 16
typedef char HASH[HASHLEN];
#define HASHHEXLEN 32
typedef char HASHHEX[HASHHEXLEN+1];
#define IN
#define OUT
/* calculate H(A1) as per HTTP Digest spec */
void DigestCalcHA1(
IN char * pszAlg,
IN char * pszUserName,
IN char * pszRealm,
IN char * pszPassword,
IN char * pszNonce,
IN char * pszCNonce,
OUT HASHHEX SessionKey
);
/* calculate request-digest/response-digest as per HTTP Digest spec */
void DigestCalcResponse(
IN HASHHEX HA1, /* H(A1) */
IN char * pszNonce, /* nonce from server */
IN char * pszNonceCount, /* 8 hex digits */
IN char * pszCNonce, /* client nonce */
IN char * pszQop, /* qop-value: "", "auth", "auth-int" */
IN char * pszMethod, /* method from the request */
IN char * pszDigestUri, /* requested URL */
IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */
OUT HASHHEX Response /* request-digest or response-digest */
);
File "digcalc.c":
#include <global.h>
#include <md5.h>
#include <string.h>
#include "digcalc.h"
void CvtHex(
IN HASH Bin,
OUT HASHHEX Hex
)
{
unsigned short i;
unsigned char j;
for (i = 0; i < HASHLEN; i++) {
j = (Bin[i] >> 4) & 0xf;
if (j <= 9)
Hex[i*2] = (j + '0');
else
Hex[i*2] = (j + 'a' - 10);
j = Bin[i] & 0xf;
if (j <= 9)
Hex[i*2+1] = (j + '0');
else
Hex[i*2+1] = (j + 'a' - 10);
};
Hex[HASHHEXLEN] = '\0';
};
/* calculate H(A1) as per spec */
void DigestCalcHA1(
IN char * pszAlg,
IN char * pszUserName,
IN char * pszRealm,
IN char * pszPassword,
IN char * pszNonce,
IN char * pszCNonce,
OUT HASHHEX SessionKey
)
{
MD5_CTX Md5Ctx;
HASH HA1;
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, pszUserName, strlen(pszUserName));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszRealm, strlen(pszRealm));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszPassword, strlen(pszPassword));
MD5Final(HA1, &Md5Ctx);
if (stricmp(pszAlg, "md5-sess") == 0) {
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, HA1, HASHLEN);
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
MD5Final(HA1, &Md5Ctx);
};
CvtHex(HA1, SessionKey);
};
/* calculate request-digest/response-digest as per HTTP Digest spec */
void DigestCalcResponse(
IN HASHHEX HA1, /* H(A1) */
IN char * pszNonce, /* nonce from server */
IN char * pszNonceCount, /* 8 hex digits */
IN char * pszCNonce, /* client nonce */
IN char * pszQop, /* qop-value: "", "auth", "auth-int" */
IN char * pszMethod, /* method from the request */
IN char * pszDigestUri, /* requested URL */
IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */
OUT HASHHEX Response /* request-digest or response-digest */
)
{
MD5_CTX Md5Ctx;
HASH HA2;
HASH RespHash;
HASHHEX HA2Hex;
// calculate H(A2)
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, pszMethod, strlen(pszMethod));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszDigestUri, strlen(pszDigestUri));
if (stricmp(pszQop, "auth-int") == 0) {
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, HEntity, HASHHEXLEN);
};
MD5Final(HA2, &Md5Ctx);
CvtHex(HA2, HA2Hex);
// calculate response
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, HA1, HASHHEXLEN);
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
MD5Update(&Md5Ctx, ":", 1);
if (*pszQop) {
MD5Update(&Md5Ctx, pszNonceCount, strlen(pszNonceCount));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszQop, strlen(pszQop));
MD5Update(&Md5Ctx, ":", 1);
};
MD5Update(&Md5Ctx, HA2Hex, HASHHEXLEN);
MD5Final(RespHash, &Md5Ctx);
CvtHex(RespHash, Response);
};
File "digtest.c":
#include <stdio.h>
#include "digcalc.h"
void main(int argc, char ** argv) {
char * pszNonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093";
char * pszCNonce = "0a4f113b";
char * pszUser = "Mufasa";
char * pszRealm = "testrealm@host.com";
char * pszPass = "Circle Of Life";
char * pszAlg = "md5";
char szNonceCount[9] = "00000001";
char * pszMethod = "GET";
char * pszQop = "auth";
char * pszURI = "/dir/index.html";
HASHHEX HA1;
HASHHEX HA2 = "";
HASHHEX Response;
DigestCalcHA1(pszAlg, pszUser, pszRealm, pszPass, pszNonce,
pszCNonce, HA1);
DigestCalcResponse(HA1, pszNonce, szNonceCount, pszCNonce, pszQop,
pszMethod, pszURI, HA2, Response);
printf("Response = %s\n", Response);
};
6 Acknowledgments
Eric W. Sink, of AbiSource, Inc., was one of the original authors
before the specification underwent substantial revision.
In addition to the authors, valuable discussion instrumental in
creating this document has come from Peter J. Churchyard, Ned Freed,
and David M. Kristol.
Jim Gettys and Larry Masinter edited this document for update.
7 References
[1] Berners-Lee, T., Fielding, R. and H. Frystyk, "Hypertext
Transfer Protocol -- HTTP/1.0", RFC1945, May 1996.
[2] Fielding, R., Gettys, J., Mogul, J., Frysyk, H., Masinter, L.,
Leach, P. and T. Berners-Lee, "Hypertext Transfer Protocol --
HTTP/1.1", RFC2616, June 1999.
[3] Rivest, R., "The MD5 Message-Digest Algorithm", RFC1321, April
1992.
[4] Freed, N. and N. Borenstein. "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message Bodies",
RFC2045, November 1996.
[5] Dierks, T. and C. Allen "The TLS Protocol, Version 1.0", RFC
2246, January 1999.
[6] Franks, J., Hallam-Baker, P., Hostetler, J., Leach, P.,
Luotonen, A., Sink, E. and L. Stewart, "An Extension to HTTP :
Digest Access Authentication", RFC2069, January 1997.
[7] Berners Lee, T, Fielding, R. and L. Masinter, "Uniform Resource
Identifiers (URI): Generic Syntax", RFC2396, August 1998.
[8] Kaliski, B.,Robshaw, M., "Message Authentication with MD5",
CryptoBytes, Sping 1995, RSA Inc,
(http://www.rsa.com/rsalabs/pubs/cryptobytes/spring95/md5.htm)
[9] Klensin, J., Catoe, R. and P. Krumviede, "IMAP/POP AUTHorize
Extension for Simple Challenge/Response", RFC2195, September
1997.
[10] Morgan, B., Alvestrand, H., Hodges, J., Wahl, M.,
"Authentication Methods for LDAP", Work in Progress.
8 Authors' Addresses
John Franks
Professor of Mathematics
Department of Mathematics
Northwestern University
Evanston, IL 60208-2730, USA
EMail: john@math.nwu.edu
Phillip M. Hallam-Baker
Principal Consultant
Verisign Inc.
301 Edgewater Place
Suite 210
Wakefield MA 01880, USA
EMail: pbaker@verisign.com
Jeffery L. Hostetler
Software Craftsman
AbiSource, Inc.
6 Dunlap Court
Savoy, IL 61874
EMail: jeff@AbiSource.com
Scott D. Lawrence
Agranat Systems, Inc.
5 Clocktower Place, Suite 400
Maynard, MA 01754, USA
EMail: lawrence@agranat.com
Paul J. Leach
Microsoft Corporation
1 Microsoft Way
Redmond, WA 98052, USA
EMail: paulle@microsoft.com
Ari Luotonen
Member of Technical Staff
Netscape Communications Corporation
501 East Middlefield Road
Mountain View, CA 94043, USA
Lawrence C. Stewart
Open Market, Inc.
215 First Street
Cambridge, MA 02142, USA
EMail: stewart@OpenMarket.com
9. Full Copyright Statement
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFCEditor function is currently provided by the
Internet Society.