Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 13
Abstract: HTTP Digest, as specified in RFC 2617, is known to be vulnerable to man-in-the-middle attacks if the client fails to authenticate the server in TLS, or if the same passwords are used for authentication in some other context without TLS. This is a general problem that exists not just with HTTP Digest, but also with other IETF protocols that use tunneled authentication. This document specifies version 2 of the HTTP Digest AKA algorithm (RFC 3310). This algorithm can be implemented in a way that it is resistant to the man-in-the-middle attack. This memo provides information for the Internet community.
Publication Date: 2005-11-01
Status Note: Informational
DOI: 10.17487/RFC4169
Link: https://doi.org/10.17487/RFC4169
Author(s): Vesa Torvinen
Jari Arkko
Mats Naslund
Keyword(s): TLS, Tunneled Authentication, Man-in-the-middle Attacks

Latest version of IETF RFC 4169

Document Versions — IETF RFC 4169

▶ IETF RFC 4169 (2005-11-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2045 [Active*]
IETF RFC 2104 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 2617 [Superseded*]
IETF RFC 3261 [Active*]
IETF RFC 3310 [Active*]

Bibliographic Reference(s)

3GPP.TS-33.102.200112 — 6 EXTERNAL
Asokan, N., Niemi, V., and K. Nyberg, "Man-in-the-Middle in Tunnelled Authentication Protocols", Cryptology ePrint Archive, http://eprint.iacr.org Report 2002/163, October 2002. EXTERNAL
Puthenkulam, J., Lortz, V., Palekar, A., and D. Simon, "The Compound Authentication Binding Problem", Work in Progress, March 2003. EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC4169.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 4169, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2. Available at https://doi.org/10.17487/RFC4169

Snippet:

IETF RFC 4169, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2. Available at https://doi.org/10.17487/RFC4169

HTML (ISO 690 compliant)

Preview:

IETF RFC 4169, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2. Available at https://doi.org/10.17487/RFC4169

Snippet:

<span class="citation"><cite>IETF RFC 4169</cite>, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2. Available at <a href="https://doi.org/10.17487/RFC4169" target="_blank" rel="noopener">https://doi.org/10.17487/RFC4169</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 4169, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2
doi: 10.17487/RFC4169
url: https://doi.org/10.17487/RFC4169

Snippet:

<li>
<cite id="bib-rfc4169">IETF RFC 4169</cite>, Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2
<span class="doi">10.17487/RFC4169</span>
</li>

Referenced By

IETF RFC 5226 [Superseded*]
IETF RFC 8126 [Active*]
IETF RFC 9048 [Active*]