Skip to content
Docs
Theory, Analysis
HTTP Digest Authentication

HTTP Digest Authentication

1. HTTP Digest Authentication

The HTTP Digest Authentication technique is an authentication technique for improving the security weaknesses of the HTTP Basic authentication technique. [Figure 1] shows an Example of the HTTP Digest authentication technique.

[Figure 1] HTTP Digest Authentication

[Figure 1] HTTP Digest Authentication

  • The Client requests a Resource from the Server.
  • Authentication is required to use the Resource requested by the Client. Therefore, the Server informs the Client of the need for authentication through the WWW-Authenticate Header. The Digest string informs the Client that the Digest authentication process is required.
    • realm is an attribute that indicates the Protection Space of the requested Resource. The Client may use a different ID and Password for each Protection Space that a Resource belongs to.
    • nonce is a random value generated by the Server every time the Client requests a Resource from the Server. The Client must deliver the nonce received from the Server back to the Server as-is. The Server rejects the Resource request if the nonce differs. Therefore, nonce can prevent Server Replay Attacks.
    • qop stands for Quality of protection and, as its name implies, indicates the Protection level.
  • The Client that receives the authentication request adds the nonce, qop, and realm attribute values received from the Server to the Authorization Header as-is, and adds the other necessary attribute values.
    • nc stands for nonce count and indicates how many times the Client has made requests to the Server using the nonce received from the Server.
    • cnonce is a random value generated by the Client. Similar to nonce, it prevents Client Replay Attacks.
    • response is a Digest that contains the information required for authentication. response is obtained through [Formula 1].
1
2
3

HA1 = MD5(username:realm:password)
HA2 = MD5(method:uri)
response = MD5(HA1:nonce:nc:cnonce:qop:HA2)
[Formula 1] response
  • When the Server confirms that the nonce and response match, it sends authentication information through the Authorization-Info Header along with the Resource requested by the Client.
    • qop indicates the Protection level used by the Server.
    • nc and cnonce must match the values sent by the client.
    • rspauth means response auth and is used for mutual authentication between the Server and the Client.
    • nextnonce indicates the nonce value that the Server wants the Client to use in its next request.

By Encoding the Password with MD5, the security weakness of Basic authentication is complemented. In addition, by utilizing the randomly issued nonce value not only for Data but also beyond it, the Server and the Client themselves can be protected.

2. References

HTTP Cookie and SessionHTTP Header