Forward Secrecy in HTTP Digest Authentication via Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current HTTP digest access authentication methods lack forward secrecy, allowing attackers to decrypt previous messages if the password or USIM/ISIM credentials are compromised, thereby compromising the security of communication between client and server devices.
Innovation Solution
Implementing a method that performs digest access authentication using a key exchange with a public component of an asymmetric key pair, where the client and server devices calculate and verify a response parameter based on the challenge and the public key, ensuring that only a matching response parameter indicates successful authentication and providing perfect forward secrecy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional HTTP digest authentication is used, then authentication functionality is provided, but forward secrecy is lacking allowing attackers to decrypt past communications if credentials are compromised
Solution Approach 1:
The patent merges traditional HTTP digest authentication with Diffie-Hellman key exchange protocol. The server includes its Diffie-Hellman public key in the WWW-Authenticate header, and the client uses this public key along with its own private key to generate a shared secret. This shared secret is then incorporated into the digest calculation, combining two authentication mechanisms into a unified protocol that provides both authentication and forward secrecy.
Solution Approach 2:
The authentication mechanism uses composite cryptographic elements: it combines the digest algorithm (MD5 or SHA-256) with Diffie-Hellman key exchange. The response parameter becomes a composite of the traditional digest calculation and the Diffie-Hellman shared secret, creating a hybrid authentication mechanism that leverages the strengths of both approaches to achieve forward secrecy.
2Reliability
If asymmetric key exchange is added to digest authentication, then forward secrecy is achieved, but the authentication process requires additional message exchanges
Solution Approach 1:
The server performs preliminary action by pre-generating its Diffie-Hellman public key before the authentication process begins. This public key is included in the WWW-Authenticate header that the server sends to the client. By preparing the public key in advance, the actual authentication exchange doesn't require the server to perform complex key generation operations during the time-critical authentication moment, reducing authentication time.
Data Source
AI summary
Mechanisms for establishing forward secrecy during digest access authentication are provided. A method is performed by a client device. The method includes performing digest access authentication with a server device. The digest access authentication includes sending a first request towards the server device for accessing a resource; and receiving a first response. The first response includes a challenge and a public component of an asymmetric key pair for a key exchange with the server device. The digest access authentication includes calculating, using a digest algorithm, a response parameter based at least on the challenge and the public component of the asymmetric key pair; and sending a second request towards the server device for accessing the resource. The second request includes the calculated response parameter. The digest access authentication includes receiving a second response from the server device that indicates successful digest access authentication with the server device.