Digest Access Authentication - Overview

Overview

Digest access authentication was originally specified by RFC 2069 (An Extension to HTTP: Digest Access Authentication). RFC 2069 specifies roughly a traditional digest authentication scheme with security maintained by a server-generated nonce value. The authentication response is formed as follows (where HA1, HA2, A1, A2 are names of string variables):

RFC 2069 was later replaced by RFC 2617 (HTTP Authentication: Basic and Digest Access Authentication). RFC 2617 introduced a number of optional security enhancements to digest authentication; "quality of protection" (qop), nonce counter incremented by client, and a client-generated random nonce. These enhancements are designed to protect against, for example, chosen-plaintext attack cryptanalysis.

If the qop directive's value is "auth" or is unspecified, then HA2 is

If the qop directive's value is "auth-int", then HA2 is

If the qop directive's value is "auth" or "auth-int", then compute the response as follows:

If the qop directive is unspecified, then compute the response as follows:

The above shows that when qop is not specified, the simpler RFC 2069 standard is followed.