Instance Digests in HTTP
obsoleted by
- rfc-9530 — Digest Fields
Extracted elements (20)
Computing and transmitting digests consumes CPU resources, adds latency, and uses HTTP header space. The Want-Digest negotiation mechanism allows recipients to signal whether and which digest is useful, avoiding unnecessary cost when the recipient will not use the digest.
Content-MD5 is locked to MD5; other algorithms such as SHA-1 and fingerprinting algorithms may be more appropriate in some circumstances. HTTP/1.1 also lacks any mechanism for a client to request a digest or indicate which algorithms it understands.
HTTP/1.1's Content-MD5 header covers only the message body, not the full instance, making it insufficient when partial content (206 responses) or delta encodings are used to reassemble an instance at the client. A new mechanism covering entire instances is needed.
The term 'instance' is introduced because HTTP/1.1 has no term for 'the value that would be returned in response to a GET at the current time for the selected variant.' The MIME-derived 'entity' concept is a poor fit for HTTP responses that may be partial or delta-encoded.
The Want-Digest/Digest mechanism is designed to coexist with the existing HTTP/1.1 Content-MD5 header. The 'contentMD5' pseudo-algorithm in Want-Digest provides a backward-compatible way to request or suppress Content-MD5 without changing existing server behavior.
A digest-algorithm in Want-Digest is acceptable if and only if it is listed with a non-zero qvalue. The sender's preferred algorithm is the one with the highest qvalue when multiple acceptable algorithms are given.
A Digest header field MAY contain multiple instance-digest values (e.g., for caches shared by users with different browsers). A recipient MAY ignore any or all instance-digests. A sender MAY send a digest without knowing whether the recipient supports or will use the algorithm.
If a digest-algorithm value other than the four initially registered ones is defined, its associated encoding MUST either be represented as a quoted string, or MUST NOT include ';' or ',' in the character set used for the encoding.
The 'contentMD5' digest-algorithm token MUST NOT be used in a Digest header field; its use is restricted to Want-Digest for negotiating the presence or absence of Content-MD5 headers.
The digest is computed on the entire instance before the application of any instance manipulation (range or delta coding). Computing the digest after such manipulation would not enable integrity checking of the reassembled instance.
A digest-algorithm value is a case-insensitive token identifying the digest computation. The IANA registry initially contains MD5 (base64-encoded output), SHA (SHA-1, base64-encoded), UNIXsum (16-bit decimal ASCII), and UNIXcksum (32-bit CRC decimal ASCII).
An 'instance' is defined as the entity that would be returned in a 200 OK response to a GET request, after applying zero or more content-codings but before any instance manipulations or transfer-codings. Instance digests are computed over the full instance.
An 'instance manipulation' is an operation on one or more instances that may result in an instance being conveyed in parts or in more than one response message; examples include range selection and delta encoding. Instance manipulations are end-to-end and often involve a client-side cache.
The Digest response header field provides one or more instance digests of the instance described by the message: 'Digest = "Digest" ":" #(instance-digest)'. The instance may be fully, partially, or not at all contained in the message-body.
The special token 'contentMD5' is added to the digest-algorithm registry to enable negotiation of the legacy Content-MD5 header via Want-Digest. A non-zero qvalue requests Content-MD5; a zero qvalue signals that the sender will ignore Content-MD5.
The Want-Digest request header field expresses the sender's desire to receive an instance digest, using quality values (qvalues) to indicate preference among algorithms: 'Want-Digest = "Want-Digest" ":" #(digest-algorithm [";", "q" "=" qvalue])'. An absent qvalue is treated as 1.0.
IANA administers the digest-algorithm name space. New values must be documented in an RFC or peer-reviewed, permanent, readily available reference with sufficient detail for interoperability. Assignments are First Come, First Served per RFC 2434.
The Digest mechanism protects HTTP instance data from accidental corruption and can detect at least one spoofing attack described in the delta-encoding specification, but it does not protect HTTP entity headers and is not intended as general defense against malicious message tampering.
The digest mechanisms described in this document do not provide authentication, privacy, or authorization. HTTP Digest Access Authentication (RFC 2617) is the appropriate mechanism for protection against malicious tampering and source authentication.
An instance digest is encoded as: digest-algorithm '=' <encoded digest output>, where the encoding format is defined per algorithm (e.g., base64 for MD5 and SHA, decimal ASCII for UNIXsum/UNIXcksum). Examples: 'MD5=HUXZLQLMuI/KZ5KDcJPcOA==' and 'UNIXsum=30637'.