54a4bb49ad
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@17942 ec53bebd-3082-4978-b11e-865c3cabbd6b
116 lines
3.3 KiB
Groff
116 lines
3.3 KiB
Groff
-- $Id$
|
|
|
|
DIGEST DEFINITIONS ::=
|
|
BEGIN
|
|
|
|
IMPORTS EncryptedData, Principal FROM krb5;
|
|
|
|
DigestInit ::= SEQUENCE {
|
|
type UTF8String, -- http, sasl, chap, cram-md5 --
|
|
channel [0] SEQUENCE {
|
|
cb-type UTF8String,
|
|
cb-binding UTF8String
|
|
} OPTIONAL,
|
|
hostname [1] UTF8String OPTIONAL -- for chap/cram-md5
|
|
}
|
|
|
|
DigestInitReply ::= SEQUENCE {
|
|
nonce UTF8String, -- service nonce/challange
|
|
opaque UTF8String, -- server state
|
|
identifier [0] UTF8String OPTIONAL
|
|
}
|
|
|
|
|
|
DigestRequest ::= SEQUENCE {
|
|
type UTF8String, -- http, sasl-md5, chap, cram-md5 --
|
|
digest UTF8String, -- http:md5/md5-sess sasl:clear/int/conf --
|
|
username UTF8String, -- username user used
|
|
authid [0] UTF8String OPTIONAL,
|
|
authentication-user [1] Principal OPTIONAL, -- principal to get key from
|
|
realm [2] UTF8String OPTIONAL,
|
|
method [3] UTF8String OPTIONAL,
|
|
uri [4] UTF8String OPTIONAL,
|
|
serverNonce UTF8String, -- same as "DigestInitReply.nonce"
|
|
clientNonce [5] UTF8String OPTIONAL,
|
|
nonceCount [6] UTF8String OPTIONAL,
|
|
qop [7] UTF8String OPTIONAL,
|
|
identifier [8] UTF8String OPTIONAL,
|
|
hostname [9] UTF8String OPTIONAL,
|
|
opaque UTF8String -- same as "DigestInitReply.opaque"
|
|
}
|
|
-- opaque = hex(cksum(type|serverNonce|identifier|hostname,digest-key))
|
|
-- serverNonce = hex(time[4bytes]random[12bytes])(-cbType:cbBinding)
|
|
|
|
|
|
DigestError ::= SEQUENCE {
|
|
reason UTF8String,
|
|
code INTEGER (-2147483648..2147483647)
|
|
}
|
|
|
|
DigestResponse ::= SEQUENCE {
|
|
responseData UTF8String,
|
|
rsp [0] UTF8String OPTIONAL,
|
|
tickets [1] SEQUENCE OF OCTET STRING OPTIONAL,
|
|
channel [2] SEQUENCE {
|
|
cb-type UTF8String,
|
|
cb-binding UTF8String
|
|
} OPTIONAL,
|
|
hash-a1 [3] OCTET STRING OPTIONAL
|
|
}
|
|
|
|
DigestReqInner ::= CHOICE {
|
|
init [0] DigestInit,
|
|
digestRequest [1] DigestRequest
|
|
}
|
|
|
|
DigestREQ ::= [APPLICATION 128] SEQUENCE {
|
|
apReq [0] OCTET STRING,
|
|
innerReq [1] EncryptedData
|
|
}
|
|
|
|
DigestRepInner ::= CHOICE {
|
|
error [0] DigestError,
|
|
initReply [1] DigestInitReply,
|
|
response [2] DigestResponse
|
|
}
|
|
|
|
DigestREP ::= [APPLICATION 129] SEQUENCE {
|
|
apRep [0] OCTET STRING,
|
|
innerRep [1] EncryptedData
|
|
}
|
|
|
|
|
|
-- HTTP
|
|
|
|
-- md5
|
|
-- A1 = unq(username-value) ":" unq(realm-value) ":" passwd
|
|
-- md5-sess
|
|
-- A1 = HEX(H(unq(username-value) ":" unq(realm-value) ":" passwd ) ":" unq(nonce-value) ":" unq(cnonce-value))
|
|
|
|
-- qop == auth
|
|
-- A2 = Method ":" digest-uri-value
|
|
-- qop == auth-int
|
|
-- A2 = Method ":" digest-uri-value ":" H(entity-body)
|
|
|
|
-- request-digest = HEX(KD(HEX(H(A1)),
|
|
-- unq(nonce-value) ":" nc-value ":" unq(cnonce-value) ":" unq(qop-value) ":" HEX(H(A2))))
|
|
-- no "qop"
|
|
-- request-digest = HEX(KD(HEX(H(A1)), unq(nonce-value) ":" HEX(H(A2))))
|
|
|
|
|
|
-- SASL:
|
|
-- SS = H( { unq(username-value), ":", unq(realm-value), ":", password } )
|
|
-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value) }
|
|
-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value), ":", unq(authzid-value) }
|
|
|
|
-- A2 = "AUTHENTICATE:", ":", digest-uri-value
|
|
-- qop == auth-int,auth-conf
|
|
-- A2 = "AUTHENTICATE:", ":", digest-uri-value, ":00000000000000000000000000000000"
|
|
|
|
-- response-value = HEX( KD ( HEX(H(A1)),
|
|
-- { unq(nonce-value), ":" nc-value, ":",
|
|
-- unq(cnonce-value), ":", qop-value, ":",
|
|
-- HEX(H(A2)) }))
|
|
|
|
END
|