Summary

authorization header parsing for digest authentication (intarweb)

Metadata

Attachments

Description

nc param in the authorization header must be string. Parsing it as number causes failing in digest authentication.

Changes and comments

[2010-09-28 16:30:43 UTC] daishi attached patch.txt (description=the patch is untested.)

[2010-09-28 19:36:49 UTC] sjamaan wrote:

How are you using this? Are you writing an authentication server or using http-client?

Before applying this, I'd like to see some code that uses this in practice so I can see it working. Nonce count is fundamentally a number, so I don't see why it needs to be kept around in string form.

When generating or checking the digest value we can always convert it to a string (it's a string of 8 hexdigits), but its native "type" is number. The idea of the nonce count is you keep around the last value and compare it to the current number. Only if it is a higher number should the request be allowed (otherwise it's a reply attack). If it's kept around as a string, you'll need to convert it back to a number anyway.

[2010-09-28 19:39:12 UTC] sjamaan changed status from new to accepted

[2010-09-28 19:39:12 UTC] sjamaan set owner to sjamaan

[2010-10-01 17:03:39 UTC] daishi wrote:

I'm writing my server code, which does digest authentication. I've been using it for chicken3/http-server. I know it's native type is integer, but the purpose is to authenticate, and for that we need 8LENHEX.

The code I am having as a workaround is: (let ((header-param 'username 'authorization hdrs)

     [[qop|(header-param 'qop 'authorization hdrs)]]
     [[nonce|(header-param 'nonce 'authorization hdrs)]]
     [[cnonce|(header-param 'cnonce 'authorization hdrs)]]
     [[nc|(let* ([nc (header-param 'nc 'authorization hdrs)]]
                [[nc-str|(number->string nc 16)]]
                [[len|(- 8 (string-length nc-str))]])
             (string-append (make-string len #\0) nc-str))]
     [[uri|(uri->string (header-param 'uri 'authorization hdrs))]]
     [[response|(header-param 'response 'authorization hdrs)]])
 (and user qop nonce cnonce nc uri response
      (equal? response
              (md5-digest
               (string-append
                (get-user user) ;;this is md5 value stored in the server side.
                ":"
                nonce
                ":"
                nc
                ":"
                cnonce
                ":"
                qop
                ":"
                (md5-digest (string-append method ":" uri)))))))

So, I had to make nc back to 8LENHEX and uri to string. I would assume its nature is a number but it has to be treated as a HEX string.

[2010-10-05 20:26:42 UTC] sjamaan changed status from accepted to closed

[2010-10-05 20:26:42 UTC] sjamaan set resolution to wontfix

[2010-10-05 20:26:42 UTC] sjamaan wrote:

You say its *purpose* is to authenticate, but its primary purpose is to prevent session *replay attacks*. For that, you need to compare the nonce count to earlier nonce count values, which is done numerically.

The fact that the nonce count is also put somewhere in the hash is to prevent an attacker from spoofing the nonce count's value.

I stick with my initial point: it's fundamentally a number, and treating it as a string in its native form is just wrong.

[2011-06-01 09:00:41 UTC] felix wrote:

Milestone 4.7.0 deleted

[2011-06-01 09:00:41 UTC] felix changed milestone from 4.7.0 to 4.8.0

[2012-09-24 21:47:48 UTC] felix changed milestone from 4.8.0 to 4.9.0

[2012-09-24 21:47:48 UTC] felix wrote:

Milestone 4.8.0 deleted