RADIUS Extension for Digest Authentication
RFC 5090

Network Working Group                                         B. Sterman
Request for Comments: 5090                               Kayote Networks
Obsoletes: 4590                                            D. Sadolevsky
Category: Standards Track                                 SecureOL, Inc.
                                                             D. Schwartz
                                                         Kayote Networks
                                                             D. Williams
                                                           Cisco Systems
                                                                 W. Beck
                                                     Deutsche Telekom AG
                                                           February 2008

               RADIUS Extension for Digest Authentication

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document defines an extension to the Remote Authentication
   Dial-In User Service (RADIUS) protocol to enable support of Digest
   Authentication, for use with HTTP-style protocols like the Session
   Initiation Protocol (SIP) and HTTP.

Sterman, et al.             Standards Track                     [Page 1]
RFC 5090         RADIUS Extension Digest Authentication    February 2008

Table of Contents

   1. Introduction ....................................................3
      1.1. Motivation .................................................3
      1.2. Terminology ................................................3
      1.3. Overview ...................................................4
   2. Detailed Description ............................................6
      2.1. RADIUS Client Behavior .....................................6
      2.2. RADIUS Server Behavior .....................................9
   3. New RADIUS Attributes ..........................................12
      3.1. Digest-Response Attribute .................................12
      3.2. Digest-Realm Attribute ....................................13
      3.3. Digest-Nonce Attribute ....................................13
      3.4. Digest-Response-Auth Attribute ............................14
      3.5. Digest-Nextnonce Attribute ................................14
      3.6. Digest-Method Attribute ...................................15
      3.7. Digest-URI Attribute ......................................15
      3.8. Digest-Qop Attribute ......................................15
      3.9. Digest-Algorithm Attribute ................................16
      3.10. Digest-Entity-Body-Hash Attribute ........................16
      3.11. Digest-CNonce Attribute ..................................17
      3.12. Digest-Nonce-Count Attribute .............................17
      3.13. Digest-Username Attribute ................................17
      3.14. Digest-Opaque Attribute ..................................18
      3.15. Digest-Auth-Param Attribute ..............................18
      3.16. Digest-AKA-Auts Attribute ................................19
      3.17. Digest-Domain Attribute ..................................19
      3.18. Digest-Stale Attribute ...................................20
      3.19. Digest-HA1 Attribute .....................................20
      3.20. SIP-AOR Attribute ........................................21
   4. Diameter Compatibility .........................................21
   5. Table of Attributes ............................................21
   6. Examples .......................................................23
   7. IANA Considerations ............................................27
   8. Security Considerations ........................................28
      8.1. Denial of Service .........................................28
      8.2. Confidentiality and Data Integrity ........................28
   9. References .....................................................29
      9.1. Normative References ......................................29
      9.2. Informative References ....................................30
   Appendix A - Changes from RFC 4590 ................................31
   Acknowledgements ..................................................31

Sterman, et al.             Standards Track                     [Page 2]
RFC 5090         RADIUS Extension Digest Authentication    February 2008

1.  Introduction

1.1.  Motivation