RADIUS Extension for Digest Authentication
obsoleted by
- rfc-5090 — RADIUS Extension for Digest Authentication
Extracted elements (28)
Digest-HA1 was introduced because when qop='auth-int', computing rspauth requires hashing the HTTP response body, which the RADIUS server does not see. By returning H(A1) to the RADIUS client, the client can compute rspauth locally after constructing the response body.
Nonces are generated by the RADIUS server rather than the RADIUS client. Generating them at the client would save a round-trip but would introduce security and operational issues; additionally, some digest algorithms such as AKA would not work with client-generated nonces.
Digest-Qop is optional in RADIUS to preserve backward compatibility with RFC 2069 minimal implementations. If Digest-Algorithm is absent, MD5 is assumed. A companion Diameter document defines equivalent Digest Authentication support for Diameter and addresses RADIUS/Diameter interoperability.
Digest-Response-Auth or Digest-HA1 MUST NOT be sent in cases other than those specified: Digest-Response-Auth for qop='auth' (or unspecified) and Digest-HA1 for qop='auth-int' with MD5-sess or AKAv1-MD5-sess algorithm, or when IPsec protects the RADIUS link.
If mandatory Digest attributes (Digest-Realm, Digest-Nonce, Digest-Method, Digest-URI, Digest-Username) are missing from an Access-Request that contains Digest-Response, the RADIUS server MUST respond with an Access-Reject.
Message-Authenticator MUST be included in every Access-Request, Access-Challenge, Access-Reject, and Access-Accept message that contains any attribute defined in this specification.
The RADIUS client MUST add a Message-Authenticator attribute (RFC 3579) to every Access-Request packet containing Digest attributes before sending it to the RADIUS server.
The RADIUS client MUST send zero or exactly one credential to the RADIUS server. Where none of the realms match the locally configured realm, the RADIUS client MUST behave as though no relevant credentials were sent.
The RADIUS server MUST check the integrity of nonces that embed a time-stamp. If the RADIUS server issued a Digest-Opaque along with the nonce, the Access-Request MUST contain a matching Digest-Opaque attribute.
The RADIUS server MUST use the User-Name attribute (not Digest-Username) to look up user credentials. The Digest-Username attribute MUST NOT be used for determining appropriate user credentials.
The RADIUS server MUST verify that the RADIUS client is authorized to serve users of the realm in the Digest-Realm attribute; if not, it MUST send an Access-Reject and SHOULD log the event.
The RADIUS server MUST verify that the user identified by User-Name is authorized to access the protection space and, if SIP-AOR is present, authorized to use the URI in SIP-AOR. Either failure MUST result in an Access-Reject.
When a RADIUS server receives an Access-Request with Digest-Method and Digest-URI but no Digest-Nonce, it MUST place a chosen nonce in a Digest-Nonce attribute and return it in an Access-Challenge. The Access-Challenge MUST also include Digest-Realm and Message-Authenticator.
When the RADIUS client receives Access-Challenge attributes Digest-Qop, Digest-Algorithm, Digest-Domain, and Digest-Opaque along with a nonce, it MUST use them when constructing the WWW-Authenticate or Proxy-Authenticate header.
Digest-Auth-Param (type 117): a pass-through for unknown auth-param extension parameters from HTTP Digest headers. Unlike other Digest-* attributes, it includes both the parameter name and value (with the '=' and quotes intact); each unknown parameter requires a separate instance. Used in Access-Request, Access-Challenge, or Access-Accept.
Digest-Entity-Body-Hash (type 112): carries hexadecimal H(entity-body) required for qop='auth-int' digest calculation. RADIUS clients MUST use this attribute to transport the entity-body hash rather than sending the full body. Used only in Access-Request packets.
Digest-HA1 (type 121): carries the hexadecimal H(A1) value (per RFC 2617 Sections 3.1.3, 3.2.1, 3.2.2.2), allowing the RADIUS client to independently compute rspauth when qop='auth-int' and the server cannot know the response body. Used only in Access-Accept packets.
Digest-Nonce-Count (type 114): fixed-length 10-octet attribute holding the nc-value (nonce count) from the HTTP-style request, used for replay-attack detection. Used only in Access-Request packets.
Digest-Nonce (type 105): transports the nonce value. In Access-Requests, it holds the client-received nonce; in Access-Challenge, it holds the server-chosen nonce. Presence of Digest-Response without Digest-Nonce triggers a nonce-request flow.
Digest-Response-Auth (type 106): enables the RADIUS server to prove password possession. The server calculates rspauth per RFC 2617 Section 3.2.3 and places it here; the RADIUS client copies it into the Authentication-Info header. Used only in Access-Accept packets.
Digest-Response (type 103): carries the request-digest value from the HTTP-style client's Authorization header. For MD5, the text field is 32 octets containing the hexadecimal representation of the 16-octet digest. Used only in Access-Request packets.
Digest-Stale (type 120): indicates nonce staleness; value is 'true' or 'false' (without quotes). Sent in Access-Challenge to signal that the nonce was expired but credentials were otherwise valid, prompting the HTTP-style client to retry without re-prompting the user.
SIP-AOR (type 122): identifies the SIP or tel URI (including parameters) whose use must be authorized. The RADIUS server uses this to enforce that a user cannot register or misuse a SIP-AOR allocated to a different user. Used only in Access-Request packets.
IANA assigned RADIUS attribute type numbers 103–122 for attributes defined by this document: Digest-Response (103), Digest-Realm (104), Digest-Nonce (105), Digest-Nextnonce (106), Digest-Response-Auth (107), Digest-Method (108), Digest-URI (109), Digest-Qop (110), Digest-Algorithm (111), Digest-Entity-Body-Hash (112), Digest-CNonce (113), Digest-Nonce-Count (114), Digest-Username (115), Digest-Opaque (116), Digest-Auth-Param (117), Digest-AKA-Auts (118), Digest-Domain (119), Digest-Stale (120), Digest-HA1 (121), and SIP-AOR (122).
All Digest-* attributes are transmitted in cleartext. A man-in-the-middle can modify or strip Digest-Qop and Digest-Algorithm attributes in a bidding-down attack, forcing use of a weaker authentication scheme. RADIUS over IPsec MUST conform to RFC 3579 Section 4.2 to mitigate this.
The Digest-HA1 attribute contains no random components when the algorithm is 'MD5' or 'AKAv1-MD5', making it vulnerable to offline dictionary attacks and enabling replay attacks. Its use is therefore restricted to sessions protected by IPsec or using session-based algorithms (MD5-sess, AKAv1-MD5-sess).
To mitigate denial-of-service attacks, the RADIUS server MUST verify it generated the nonce received from the HTTP-style client; this SHOULD be done statelessly, for example by embedding a cryptographic signature in the nonce as described in RFC 2617 Section 3.2.1.
All Digest-* attributes share the format: Type (1 octet), Length (1 octet), Text (variable, minimum length 3). Quote and backslash characters from HTTP-style directive quoted-string values are escaped; surrounding quotes are stripped.