1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
-- $Id: digest.asn1,v 1.9 2006/08/25 11:57:54 lha Exp $
DIGEST DEFINITIONS ::=
BEGIN
IMPORTS EncryptedData, Principal FROM krb5;
DigestInit ::= SEQUENCE {
type UTF8String, -- http, sasl, chap, cram-md5 --
channel [0] SEQUENCE {
cb-type UTF8String,
cb-binding UTF8String
} OPTIONAL,
hostname [1] UTF8String OPTIONAL -- for chap/cram-md5
}
DigestInitReply ::= SEQUENCE {
nonce UTF8String, -- service nonce/challange
opaque UTF8String, -- server state
identifier [0] UTF8String OPTIONAL
}
DigestRequest ::= SEQUENCE {
type UTF8String, -- http, sasl-md5, chap, cram-md5 --
digest UTF8String, -- http:md5/md5-sess sasl:clear/int/conf --
username UTF8String, -- username user used
authid [0] UTF8String OPTIONAL,
authentication-user [1] Principal OPTIONAL, -- principal to get key from
realm [2] UTF8String OPTIONAL,
method [3] UTF8String OPTIONAL,
uri [4] UTF8String OPTIONAL,
serverNonce UTF8String, -- same as "DigestInitReply.nonce"
clientNonce [5] UTF8String OPTIONAL,
nonceCount [6] UTF8String OPTIONAL,
qop [7] UTF8String OPTIONAL,
identifier [8] UTF8String OPTIONAL,
hostname [9] UTF8String OPTIONAL,
opaque UTF8String -- same as "DigestInitReply.opaque"
}
-- opaque = hex(cksum(type|serverNonce|identifier|hostname,digest-key))
-- serverNonce = hex(time[4bytes]random[12bytes])(-cbType:cbBinding)
DigestError ::= SEQUENCE {
reason UTF8String,
code INTEGER (-2147483648..2147483647)
}
DigestResponse ::= SEQUENCE {
responseData UTF8String,
rsp [0] UTF8String OPTIONAL,
tickets [1] SEQUENCE OF OCTET STRING OPTIONAL,
channel [2] SEQUENCE {
cb-type UTF8String,
cb-binding UTF8String
} OPTIONAL,
hash-a1 [3] OCTET STRING OPTIONAL
}
DigestReqInner ::= CHOICE {
init [0] DigestInit,
digestRequest [1] DigestRequest
}
DigestREQ ::= [APPLICATION 128] SEQUENCE {
apReq [0] OCTET STRING,
innerReq [1] EncryptedData
}
DigestRepInner ::= CHOICE {
error [0] DigestError,
initReply [1] DigestInitReply,
response [2] DigestResponse
}
DigestREP ::= [APPLICATION 129] SEQUENCE {
apRep [0] OCTET STRING,
innerRep [1] EncryptedData
}
-- HTTP
-- md5
-- A1 = unq(username-value) ":" unq(realm-value) ":" passwd
-- md5-sess
-- A1 = HEX(H(unq(username-value) ":" unq(realm-value) ":" passwd ) ":" unq(nonce-value) ":" unq(cnonce-value))
-- qop == auth
-- A2 = Method ":" digest-uri-value
-- qop == auth-int
-- A2 = Method ":" digest-uri-value ":" H(entity-body)
-- request-digest = HEX(KD(HEX(H(A1)),
-- unq(nonce-value) ":" nc-value ":" unq(cnonce-value) ":" unq(qop-value) ":" HEX(H(A2))))
-- no "qop"
-- request-digest = HEX(KD(HEX(H(A1)), unq(nonce-value) ":" HEX(H(A2))))
-- SASL:
-- SS = H( { unq(username-value), ":", unq(realm-value), ":", password } )
-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value) }
-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value), ":", unq(authzid-value) }
-- A2 = "AUTHENTICATE:", ":", digest-uri-value
-- qop == auth-int,auth-conf
-- A2 = "AUTHENTICATE:", ":", digest-uri-value, ":00000000000000000000000000000000"
-- response-value = HEX( KD ( HEX(H(A1)),
-- { unq(nonce-value), ":" nc-value, ":",
-- unq(cnonce-value), ":", qop-value, ":",
-- HEX(H(A2)) }))
END
|
