RFC 6331

Moving DIGEST-MD5 to Historic

📅 published July 2011, from ietf

Internet Engineering Task Force (IETF) 🎀

okay bestie, this one is RFC 6331 🦋 and it's called Moving DIGEST-MD5 to Historic. It was written by A. Melnikov from Isode Limited, it's dated July 2011, and it's in the Informational category, so it's published for information and isn't a Standards Track spec ✨. It obsoletes RFC 2831, and its ISSN is 2070-1721 💅.

Abstract 🌸

this memo is all about the problems with the DIGEST-MD5 Simple Authentication and Security Layer (SASL) mechanism as specified in RFC 2831 😭. it marks DIGEST-MD5 as OBSOLETE in the IANA Registry of SASL mechanisms and moves RFC 2831 over to Historic status 🪦.

Status of This Memo 🧚

this document is not an Internet Standards Track specification, it's just published for informational purposes 💜.

it's a product of the Internet Engineering Task Force (IETF) and it represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). not every document the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 if you want the details 🙈.

for the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc6331 🔗.

Copyright Notice 🌈

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the date this document was published. please read these carefully, because they explain your rights and restrictions for this document 📜. Code Components pulled out of this document need to include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🫶.

this document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. the people who control the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process 😬. unless you get an adequate license from whoever controls the copyright in those materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be made outside the IETF Standards Process either. the exceptions are formatting it for publication as an RFC or translating it into languages other than English ✨.

Table of Contents 📋

1.    Introduction and Overview . . . . . . . . . . . . . . . . . . 2
2.    Security Considerations . . . . . . . . . . . . . . . . . . . 5
3.    IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5
4.    Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . 5
5.    References  . . . . . . . . . . . . . . . . . . . . . . . . . 5
5.1.  Normative References  . . . . . . . . . . . . . . . . . . . . 5
5.2.  Informative References  . . . . . . . . . . . . . . . . . . . 5

1. Introduction and Overview ✨

okay so [RFC2831] explains how HTTP Digest Authentication [RFC2617] can be used as a Simple Authentication and Security Layer (SASL) [RFC4422] mechanism for any protocol that has a SASL profile 💖. it was meant to be an upgrade over CRAM-MD5 [RFC2195] and a convenient way to use one authentication mechanism for web, email, the Lightweight Directory Access Protocol (LDAP), and other protocols 🌸. you could argue it's better than CRAM-MD5, but lots of implementors said the extra complexity of DIGEST-MD5 makes it really hard to implement fully and securely 💀.

here's an incomplete list of the problems with the DIGEST-MD5 mechanism as specified in [RFC2831] 🔍:

The mechanism has too many options and modes. Some of them aren't well described and aren't widely implemented 🙃. For example, DIGEST-MD5 lets the "qop" directive contain multiple values, but it also lets you specify multiple qop directives. How to handle multiple options isn't specified, so there are minor interoperability problems: some implementations squash multiple qop values into one, while others treat multiple qops as an error 😭. Another example is the empty authorization identity. In SASL, an empty authorization identity means the client is willing to authorize as the authentication identity. The document isn't clear on whether the authzid must be omitted or whether it can be given with an empty value to convey this 🤔. Backward compatibility with HTTP Digest makes it even messier. For example, DIGEST-MD5 requires all usernames/passwords that can be fully represented in the ISO-8859-1 charset to be down converted from UTF-8 [RFC3629] to ISO-8859-1 [ISO-8859-1] 🫠. And then there's quoted strings. Handling characters that need escaping isn't properly described, and the DIGEST-MD5 document has no examples showing correct behavior 😩.
The DIGEST-MD5 document uses ABNF from RFC 822 [RFC0822]. That allows an extra construct and lets "implied folding whitespace" get inserted in lots of places 🌀. The difference from the more common ABNF defined in [RFC5234] confuses some implementors, so many implementations don't accept folding whitespace in many of the places where it's allowed 🙈.
The DIGEST-MD5 document uses the concept of a "realm" to define a collection of accounts. A DIGEST-MD5 server can support one or more realms 🏰. The document doesn't give any guidance on how realms should be named, and more importantly, how they can be entered in User Interfaces (UIs) 😵‍💫. So many DIGEST-MD5 clients have confusing UIs, don't let users enter a realm, and/or don't let users pick one of the server-supported realms 💅.
Using the username in the inner hash is problematic. The inner hash of DIGEST-MD5 is an MD5 hash of colon-separated username, realm, and password 🔐. Implementations may choose to store inner hashes instead of clear text passwords. This has some useful properties, like protection from compromise of authentication databases that contain the same username and password on other servers if a server with that username and password gets compromised, but it's rarely done in practice 🥲. First, the inner hash isn't compatible with widely deployed Unix password databases. Second, changing the username would invalidate the inner hash 💔.
The descriptions of the DES/3DES [DES] and RC4 security layers aren't good enough to produce independently developed interoperable implementations 🧩. In the DES/3DES case, this is partly a problem with existing DES APIs 🙄.
The DIGEST-MD5 outer hash (the value of the "response" directive) doesn't protect the whole authentication exchange, which makes the mechanism vulnerable to "man-in-the-middle" (MITM) attacks, like modifying the list of supported qops or ciphers 👀🚨.
The following features are missing from DIGEST-MD5, which makes it insecure or unsuitable for use in protocols:
- A. Channel bindings [RFC5056].
- B. Hash agility (meaning there's no easy way to replace the MD5 hash function with another one).
- C. Support for SASLPrep [RFC4013] or any other type of Unicode character normalization of usernames and passwords. The original DIGEST-MD5 document predates SASLPrep and doesn't recommend any Unicode character normalization 🌍.
The cryptographic primitives in DIGEST-MD5 aren't up to today's standards, in particular:
- A. The MD5 hash is weak enough that a brute force attack on DIGEST-MD5 is easy with common hardware [RFC6151] 💻.
- B. The RC4 algorithm is prone to attack when used as the security layer without discarding the initial key stream output [RFC6229] 😱.
- C. The DES cipher for the security layer is considered insecure because of its small key space [RFC3766] 🔓.

note that most of the problems listed above are already present in the HTTP Digest authentication mechanism 🫤.

because DIGEST-MD5 is defined as an extensible mechanism, it's possible to fix most of the problems above 🛠️. but that would make the implementation complexity of an already complex mechanism even worse, so the effort isn't worth the cost 💸. plus, a "fixed" DIGEST-MD5 specification would probably either not interoperate with any existing implementation of [RFC2831] or be vulnerable to various downgrade attacks 🥴.

despite DIGEST-MD5 seeing some deployment on the Internet, this specification recommends obsoleting it, because DIGEST-MD5 as implemented isn't a reasonable candidate for further standardization 🚫. it should be deprecated in favor of one or more new password-based mechanisms that are currently being designed ✨.

the Salted Challenge Response Authentication Mechanism (SCRAM) family of SASL mechanisms [RFC5802] was developed to provide similar features to DIGEST-MD5, but with a better design 👑.

to be continued in part 2 🌈💖

5.2. Informative References 📚✨

Okay, bestie, this is the reading list 🫶 These are the extra references the doc points to, not the must-reads. Nothing in here is required to get the spec working, but they're the backstory 💅

[DES]         National Institute of Standards and Technology, "Data
              Encryption Standard (DES)", FIPS PUB 46-3,
              October 1999.

[ISO-8859-1]  International Organization for Standardization,
              "Information technology - 8-bit single-byte coded
              graphic character sets - Part 1: Latin alphabet No. 1",
              ISO/IEC 8859-1, 1998.

[RFC0822]     Crocker, D., "Standard for the format of ARPA Internet
              text messages", STD 11, RFC 822, August 1982.

[RFC2195]     Klensin, J., Catoe, R., and P. Krumviede, "IMAP/POP
              AUTHorize Extension for Simple Challenge/Response",
              RFC 2195, September 1997.

[RFC3629]     Yergeau, F., "UTF-8, a transformation format of ISO
              10646", STD 63, RFC 3629, November 2003.

[RFC3766]     Orman, H. and P. Hoffman, "Determining Strengths For
              Public Keys Used For Exchanging Symmetric Keys",
              BCP 86, RFC 3766, April 2004.

[RFC4013]     Zeilenga, K., "SASLprep: Stringprep Profile for User
              Names and Passwords", RFC 4013, February 2005.

[RFC4422]     Melnikov, A. and K. Zeilenga, "Simple Authentication
              and Security Layer (SASL)", RFC 4422, June 2006.

[RFC5056]     Williams, N., "On the Use of Channel Bindings to Secure
              Channels", RFC 5056, November 2007.

[RFC5234]     Crocker, D. and P. Overell, "Augmented BNF for Syntax
              Specifications: ABNF", STD 68, RFC 5234, January 2008.

[RFC5802]     Newman, C., Menon-Sen, A., Melnikov, A., and N.
              Williams, "Salted Challenge Response Authentication
              Mechanism (SCRAM) SASL and GSS-API Mechanisms",
              RFC 5802, July 2010.

[RFC6151]     Turner, S. and L. Chen, "Updated Security
              Considerations for the MD5 Message-Digest and the HMAC-
              MD5 Algorithms", RFC 6151, March 2011.

[RFC6229]     Strombergson, J. and S. Josefsson, "Test Vectors for
              the Stream Cipher RC4", RFC 6229, May 2011.

Author's Address 💖

The author, Alexey Melnikov, is at Isode Limited, and you can reach him here 🦋

Alexey Melnikov
Isode Limited
5 Castle Business Village
36 Station Road
Hampton, Middlesex  TW12 2BX
UK

EMail: Alexey.Melnikov@isode.com
URI:   http://www.melnikov.ca/

That's the whole thing, bestie! 🌈🎀✨

📦 where this page comes from

ietf: rfc6331 2011-07
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms