RADIUS Extension for Digest Authentication
RFC 5090
Document | Type |
RFC - Proposed Standard
(February 2008; Errata)
Obsoletes RFC 4590
|
|
---|---|---|---|
Last updated | 2015-10-14 | ||
Stream | IETF | ||
Formats | plain text pdf html bibtex | ||
Reviews | |||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 5090 (Proposed Standard) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Dan Romascanu | ||
Send notices to | (None) |
Network Working Group B. Sterman Request for Comments: 5090 Kayote Networks Obsoletes: 4590 D. Sadolevsky Category: Standards Track SecureOL, Inc. D. Schwartz Kayote Networks D. Williams Cisco Systems W. Beck Deutsche Telekom AG February 2008 RADIUS Extension for Digest Authentication Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Abstract This document defines an extension to the Remote Authentication Dial-In User Service (RADIUS) protocol to enable support of Digest Authentication, for use with HTTP-style protocols like the Session Initiation Protocol (SIP) and HTTP. Sterman, et al. Standards Track [Page 1] RFC 5090 RADIUS Extension Digest Authentication February 2008 Table of Contents 1. Introduction ....................................................3 1.1. Motivation .................................................3 1.2. Terminology ................................................3 1.3. Overview ...................................................4 2. Detailed Description ............................................6 2.1. RADIUS Client Behavior .....................................6 2.2. RADIUS Server Behavior .....................................9 3. New RADIUS Attributes ..........................................12 3.1. Digest-Response Attribute .................................12 3.2. Digest-Realm Attribute ....................................13 3.3. Digest-Nonce Attribute ....................................13 3.4. Digest-Response-Auth Attribute ............................14 3.5. Digest-Nextnonce Attribute ................................14 3.6. Digest-Method Attribute ...................................15 3.7. Digest-URI Attribute ......................................15 3.8. Digest-Qop Attribute ......................................15 3.9. Digest-Algorithm Attribute ................................16 3.10. Digest-Entity-Body-Hash Attribute ........................16 3.11. Digest-CNonce Attribute ..................................17 3.12. Digest-Nonce-Count Attribute .............................17 3.13. Digest-Username Attribute ................................17 3.14. Digest-Opaque Attribute ..................................18 3.15. Digest-Auth-Param Attribute ..............................18 3.16. Digest-AKA-Auts Attribute ................................19 3.17. Digest-Domain Attribute ..................................19 3.18. Digest-Stale Attribute ...................................20 3.19. Digest-HA1 Attribute .....................................20 3.20. SIP-AOR Attribute ........................................21 4. Diameter Compatibility .........................................21 5. Table of Attributes ............................................21 6. Examples .......................................................23 7. IANA Considerations ............................................27 8. Security Considerations ........................................28 8.1. Denial of Service .........................................28 8.2. Confidentiality and Data Integrity ........................28 9. References .....................................................29 9.1. Normative References ......................................29 9.2. Informative References ....................................30 Appendix A - Changes from RFC 4590 ................................31 Acknowledgements ..................................................31 Sterman, et al. Standards Track [Page 2] RFC 5090 RADIUS Extension Digest Authentication February 2008 1. Introduction 1.1. Motivation The HTTP Digest Authentication mechanism, defined in [RFC2617], was subsequently adapted for use with SIP [RFC3261]. Due to the limitations and weaknesses of Digest Authentication (see [RFC2617],Show full document text