3

Having just finished the chapter on digest authentication in HTTP - The Definitive Guide, I'm not quite sure what the server stores as the client's secret in its database:

  • the client's plaintext password or
  • an MD5 hash of the client's password concatenated with the username and realm

On page 287 of the book, it reads

The client and the server both know the secret password

Also this answer states that

[digest authentication] makes it necessary to store the passwords at the server in plain or in some equivalent form

This answer also indicates that the server stores the password in plaintext:

the server looks up the expected password for the user from its user DB

Yet RFC 2617 contradicts this (emphasis mine):

Normally [what the server stores] might contain pairs consisting of username and H(A1), where H(A1) is the digested value of the username, realm, and password as described above.

My question is: In the context of digest authentication, does the server store the client's plaintext password or does it store a hash of the plaintext password (combined with username and realm)?

Note: This is a theoretical question, I'm not intending to use Digest Authentication over non-encrypted HTTP and I know MD5 is prone to dictionary attacks.

† With "secret" I mean the string that the client combines with a nonce received from the server and then hashes to send it to the server for authentication.

4

It depends on the implementation. Digest authentication is just an authentication mechanism for communicating the credentials. The server will receive the plaintext password when the password is set, but can choose what it wants to do with it based on implementation. It could store it reversibly encrypted (effectively plain-text) and compare to the hash calculated on both sides (insecure), or it could hash the hash of the input from the user and verify it matches a stored hash that is similarly hashed with the nonce depending on how the server is storing the password.

For a windows server, it will depend on if the domain controller that is backing it has reversible passwords turned on or not.

  • 1
    Thanks for your answer AJ! I assume, since the client uses the server-generated nonce to hash whatever secret it is sending to the server, that the server can somehow communicate to the client what the server is expecting: either hash(nonce + username:realm:password) or hash(nonce + hash(username:realm:password)). – Matthias Braun Jul 28 '17 at 8:59
  • @MatthiasBraun - I updated my answer. I was a bit rushed and confused digest with basic. The basic concept is still the same, but there were some inaccuracies in my initial answer that should now be fixed. – AJ Henderson Jul 28 '17 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.