Re: Protocol Authentication (was Re: Collection convergence?)

[Joe Gregorio <joe.gregorio@xxxxxxxxx>]

On Fri, 18 Mar 2005 15:32:35 -0500, Robert Sayre <mint@xxxxxxxxxxxxxxx> wrote:
> Joe Gregorio wrote:
> 
> > Now, mandating that a 'client' needs to be able to interact with a
> > server using Digest is something competely different. That *may* be
> > a way to increase interopability. It seems that that is the tact
> > that WebDAV chose, unless I am reading the spec incorrectly:
> 
> You read that correctly, but the WebDAV folks consider it a mistake.
> 
>    "RFC2518 advocates Digest Authentication. There was some concern that
>     although it  doesnt transmit the password in the clear, the password
>     or password  equivalent still has to reside in a file on the server
>     basically in the  clear. They cant rely on that file  being secure
>     and felt that Basic Authentication over SSL or other transport  level
>     security was a better option."
> 
>       -- http://www.webdav.org/wg/rfcdev/issues.htm

That's interesting since Digest is 
designed to allow the server to *not* have to store
the plaintext password. That is, in the nomenclature
of RFC 2617, the value H(A1) is constant, being a hash
of :

  A1       = unq(username-value) ":" unq(realm-value) ":" passwd

Which means that H(A1) can be stored locally and not the password.
Of course, if someone walks off with a copy of H(A1) then they can 
get access to your files, but they won't know your password. So in short,
I think I've talked myself into agreeing with their assessment.

    -joe

-- 
Joe Gregorio        http://bitworking.org