Digest access authentication

lastmod 2024-01-09created 2017-12-078 edits

Digest access authentication is one of the agreed-upon methods a web server can use to negotiate credentials, such as username or password, with a user's web browser. This can be used to confirm the identity of a user before sending sensitive information, such as online banking transaction history. It applies a hash function to the username and password before sending them over the network. In contrast, basic access authentication uses the easily reversible Base64 encoding instead of encryption, making it non-secure unless used in conjunction with TLS.

Technically, digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol.

About

• One of the authentication methods that work over HTTP
• Authenticates with an MD5 value combining the username, password, etc.
• Authentication with stronger security than basic authentication

How it works

1. (Client → Server) Requests a page
2. (Server → Client) Notifies that Digest authentication is required
3. (Client → Server) When the user enters an ID/password, merges server information + client information, encrypts it with MD5, and sends it

In other words, with Digest authentication the server does not simply receive the password from the client. It receives a value (Response) that combines several things and is hashed with MD5, as below.

HA1 = MD5( "사용자명:영역명:패스워드" )
HA2 = MD5( "HTTP요청방식:URI주소" )
Response = MD5( "HA1값:서버NONCE:요청카운터:클라이언트NONCE:보호품질코드:HA2값" )

For the server to authenticate (log in) the user, it must build a valid Response value in the same way from the values it knows, then compare whether the Response sent by the client matches it.

See also

• HTTP
• Authentication
• HTTP:Authentication
• Cryptographic nonce
• HTTPBasicAuth (python)
• HTTPDigestAuth (python)

Favorite site

• Wikipedia (en) Digest access authentication
• HTTP digest authentication - ZetaWiki
• Understanding HTTP authentication basics and summary (Basic, Digest)
• HTTP Digest authentication | Ssup2 Blog
• [Recommended] Digest authentication (1) - Digest authentication and its characteristics | Feel5ny's dev log ¹

References