Subject: RE: Digest Authentication

From: "Clemm, Geoff" <[email-masked]>
Date: Tue, 16 Oct 2001 11:46:53 -0400

Are you sure you are not confusing digest authentication with basic
authentication?  With digest authentication, a server only needs to
expose its passwords in a cryptographically secure hash-coded form.

Cheers,
Geoff

-----Original Message-----
From: Dylan Barrell [mailto:[email-masked]]
Sent: Tuesday, October 16, 2001 11:13 AM
To: WebDAV
Subject: Digest Authentication

I would like to propose a small change to the webDAV specification.

Digest Authentication requires that a server store its passwords in such a
way that they be available in clear text format.

Our experience with our customers has shown that this is TOTALLY
UNACCEPTABLE.

As a result, we will not be able to implement digest authentication in our
webDAV server.

I would like to propose that the Digest Authentication requirement be
demoted from mandatory to optional.

--Dylan

---

From: "Stefan Eissing" <[email-masked]>
Date: Tue, 16 Oct 2001 17:56:57 +0200

Actually, you do not need to store cleartext in both cases.

As Geoff explained, digest requires the server to store
a secure hash of the username/password. You can use the
same hash to verify Basic authentication, since the client
send the password in (almost) clear text.

Best Regards, Stefan

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Clemm, Geoff
> Sent: Tuesday, October 16, 2001 5:47 PM
> To: WebDAV
> Subject: RE: Digest Authentication
>
>

---

From: "Julian Reschke" <[email-masked]>
Date: Tue, 16 Oct 2001 18:04:12 +0200

Hi.

RFC2518 and ACL define elements that contain a text that "that can be
displayed to the user explaining the nature of the response" ([1]) or "is a
human-readable description of what this privilege controls access to" ([2]).

Both specs avoid speaking of I18N in this context.

I suggest the following:

1) Add wording specifying that these elements MUST be labelled with
xml:lang, and that server SHOULD use the HTTP Accept-Language headers to
determine a suitable language.

2) Update the examples to include xml:lang="en".

[1]
<http://www.greenbytes.de/tech/webdav/rfc2518.html#ELEMENT_responsedescripti
on>
[2]
<http://www.webdav.org/acl/protocol/draft-ietf-webdav-acl-06.htm#_Toc5177669
11>

---

From: "Stefan Eissing" <[email-masked]>
Date: Tue, 16 Oct 2001 18:19:20 +0200

As an afterthought: If Dylan wants to be safe that somebody
stealing the encrypted passwords cannot log in to the server,
then Digest Authentication is indeed not a good idea. (See
RFC 2617, Chapter 4.13).

If you need to be safe in the case of stolen "password files",
you need to upgrade to TLS and basic auth or use client certs.

//Stefan

> [mailto:[email-masked]]On Behalf Of Stefan Eissing
> Sent: Tuesday, October 16, 2001 5:57 PM
> To: Clemm, Geoff; WebDAV

---

From: "Jim Whitehead" <[email-masked]>
Date: Tue, 16 Oct 2001 09:42:15 -0700

> expose its passwords in a cryptographically secure hash-coded form.

I'm going to make an educated guess here. Since Dylan works on a DAV server
called  "Livelink Gateway", I suspect the architecture of this
implementation is a wrapper around an existing content management system,
Livelink. I will also guess that Livelink does not natively handle Digest
authentication. Hence, to handle Digest authentication the Livelink Gateway
needs to be able to convert the hashed username/password pair it receives
from the client into a cleartext version of same, which it can then pass
along to Livelink.

The alternative is to change Livelink itself so it can handle Digest
authentication. Then the gateway can call Livelink, pass the Digest
credentials, and then get back a pass/fail result. However, this requires
changing the API to Livelink, and requires that customers who add the
Livelink Gateway must update Livelink as well.

That all said, I'm not very much in favor of weakening the Digest
authentication requirements.  Trends on the Internet are towards greater
security, and the recent rash of attacks on Web servers shows that the
cracker community has an interest in breaking Web servers.  I suspect that
as DAV becomes more mainstream, it will in turn be a focus of attacks. I'd
like for us to have a solid security infrastructure in place when this day
comes.

- Jim