HTTP Digest Authentication: Does the server store plaintext passwords?

Question

Having just finished the chapter on digest authentication in HTTP - The Definitive Guide, I'm not quite sure what the server stores as the client's secret^† in its database:

• the client's plaintext password or
• an MD5 hash of the client's password concatenated with the username and realm

On page 287 of the book, it reads

The client and the server both know the secret password

Also this answer states that

[digest authentication] makes it necessary to store the passwords at the server in plain or in some equivalent form

This answer also indicates that the server stores the password in plaintext:

the server looks up the expected password for the user from its user DB

Yet RFC 2617 contradicts this (emphasis mine):

Normally [what the server stores] might contain pairs consisting of username and H(A1), where H(A1) is the digested value of the username, realm, and password as described above.

My question is: In the context of digest authentication, does the server store the client's plaintext password or does it store a hash of the plaintext password (combined with username and realm)?

_{Note: This is a theoretical question, I'm not intending to use Digest Authentication over non-encrypted HTTP and I know MD5 is prone to dictionary attacks.}

_{† With "secret" I mean the string that the client combines with a nonce received from the server and then hashes to send it to the server for authentication.}

Answer 1

It depends on the implementation. Digest authentication is just an authentication mechanism for communicating the credentials. The server will likely receive the plaintext password when the password is initially set, but can choose what it wants to do with it based on implementation. It could store it reversibly encrypted (effectively plain-text) and compare to the hash calculated on both sides (insecure), or it could hash the hash of the input from the user and verify it matches a stored hash that is similarly hashed with the nonce depending on how the server is storing the password.

For a windows server, it will depend on if the domain controller that is backing it has reversible passwords turned on or not.

Answer 2

Please read Wikipedia article on Digest access authentication. According to it, the server must either:

• store cleartext password,
• store password encrypted using reversible encryption,
• store digested value of the username, realm, and password.