%% You should probably cite rfc4169 instead of this I-D.
@techreport{torvinen-http-digest-aka-v2-02,
    number =    {draft-torvinen-http-digest-aka-v2-02},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-torvinen-http-digest-aka-v2/02/},
    author =    {Mats Naslund and Jari Arkko and Vesa Torvinen},
    title =     {{Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2}},
    pagetotal = 13,
    year =      2004,
    month =     nov,
    day =       15,
    abstract =  {HTTP Digest, as specified in RFC 2617, is known to be vulnerable to man-in-the-middle attacks if the client fails to authenticate the server in TLS, or if the same passwords are used for authentication in some other context without TLS. This is a general problem that exists not just with HTTP Digest, but also with other IETF protocols that use tunneled authentication. This document specifies version 2 of the HTTP Digest AKA algorithm (RFC 3310). This algorithm can be implemented in a way that it is resistant to the man-in-the-middle attack. This memo provides information for the Internet community.},
}