RADIUS Extension for Digest Authentication
RFC 5090
| Document | Type |
RFC - Proposed Standard
(February 2008; Errata)
Obsoletes RFC 4590
|
|
|---|---|---|---|
| Last updated | 2015-10-14 | ||
| Stream | IETF | ||
| Formats | plain text pdf html bibtex | ||
| Reviews | |||
| Stream | WG state | (None) | |
| Document shepherd | No shepherd assigned | ||
| IESG | IESG state | RFC 5090 (Proposed Standard) | |
| Consensus Boilerplate | Unknown | ||
| Telechat date | |||
| Responsible AD | Dan Romascanu | ||
| Send notices to | (None) | ||
Network Working Group B. Sterman
Request for Comments: 5090 Kayote Networks
Obsoletes: 4590 D. Sadolevsky
Category: Standards Track SecureOL, Inc.
D. Schwartz
Kayote Networks
D. Williams
Cisco Systems
W. Beck
Deutsche Telekom AG
February 2008
RADIUS Extension for Digest Authentication
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Abstract
This document defines an extension to the Remote Authentication
Dial-In User Service (RADIUS) protocol to enable support of Digest
Authentication, for use with HTTP-style protocols like the Session
Initiation Protocol (SIP) and HTTP.
Sterman, et al. Standards Track [Page 1]
RFC 5090 RADIUS Extension Digest Authentication February 2008
Table of Contents
1. Introduction ....................................................3
1.1. Motivation .................................................3
1.2. Terminology ................................................3
1.3. Overview ...................................................4
2. Detailed Description ............................................6
2.1. RADIUS Client Behavior .....................................6
2.2. RADIUS Server Behavior .....................................9
3. New RADIUS Attributes ..........................................12
3.1. Digest-Response Attribute .................................12
3.2. Digest-Realm Attribute ....................................13
3.3. Digest-Nonce Attribute ....................................13
3.4. Digest-Response-Auth Attribute ............................14
3.5. Digest-Nextnonce Attribute ................................14
3.6. Digest-Method Attribute ...................................15
3.7. Digest-URI Attribute ......................................15
3.8. Digest-Qop Attribute ......................................15
3.9. Digest-Algorithm Attribute ................................16
3.10. Digest-Entity-Body-Hash Attribute ........................16
3.11. Digest-CNonce Attribute ..................................17
3.12. Digest-Nonce-Count Attribute .............................17
3.13. Digest-Username Attribute ................................17
3.14. Digest-Opaque Attribute ..................................18
3.15. Digest-Auth-Param Attribute ..............................18
3.16. Digest-AKA-Auts Attribute ................................19
3.17. Digest-Domain Attribute ..................................19
3.18. Digest-Stale Attribute ...................................20
3.19. Digest-HA1 Attribute .....................................20
3.20. SIP-AOR Attribute ........................................21
4. Diameter Compatibility .........................................21
5. Table of Attributes ............................................21
6. Examples .......................................................23
7. IANA Considerations ............................................27
8. Security Considerations ........................................28
8.1. Denial of Service .........................................28
8.2. Confidentiality and Data Integrity ........................28
9. References .....................................................29
9.1. Normative References ......................................29
9.2. Informative References ....................................30
Appendix A - Changes from RFC 4590 ................................31
Acknowledgements ..................................................31
Sterman, et al. Standards Track [Page 2]
RFC 5090 RADIUS Extension Digest Authentication February 2008
1. Introduction
1.1. Motivation
The HTTP Digest Authentication mechanism, defined in [RFC2617], was
subsequently adapted for use with SIP [RFC3261]. Due to the
limitations and weaknesses of Digest Authentication (see [RFC2617],
Show full document text