Flaw in HTTP Digest Authentication

Question

I am working through my textbook and I came across this question:

Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication.

GET URI HTTP/1.1
Host: URL
...
Authorization: Digest username="UserName", realm="Realm", nonce="Nonce",
uri="URI", algorithm=MD5, response="Response", qop=QoP, nc=NonceCount,
cnonce="ClientNonce"

How will the server validate this response?

I came up with this scheme:

    1. Use UserName and Realm to retrieve D1 =
       md5sum(Username:Realm:Password) from the password file.

    2. Compute D2 = md5sum(GET:URI).

    3. Compute r = md5sum(D1 : Nonce:NonceCount:ClientNonce:QoP:D2).

    4. If r == Response, authentication succeeds and return the content of
       URI; otherwise authentication fails and return an error code.

Is this correct or are there any flaws in my method?

The only thing I can think of is that a Man in the Middle attacker could tell clients to use basic access authentication because digest authentication provides no mechanism for clients to verify the server's identity. It may also be vulnerable to replay attacks, i.e., if the client can replay the message digest created by the encryption, the server will allow access to the client.

Answer 1

I came up with this scheme:

Digest authentication is defined in RFC 2617 so please refer to this documentation instead of coming up with your own scheme.

It may also be vulnerable to replay attacks...

The nonce set by the server is used to defend against replay attacks, i.e. only replies are accepted which match the unpredictable nonce.

What could the flaws be then? I am not confident that the scheme that I used is flawless.

While Digest solves the problem of authenticating the client over an insecure channel it makes it necessary to store the passwords at the server in plain or in some equivalent form in order to verify the data sent by the client. This shifts the vulnerability problem from the data transport to the server. And in effect it enables an attacker to not compromise a single account but zillions at once.

Which means you should better use TLS to secure the channel and keep the password stored in a secure in irreversible form, so that an attacker cannot compromise accounts easily and en mass. Additionally this solves the problem of missing identification of the server.