RFC2617- HTTP Authentication自译本-(1)

王朝other·作者佚名  2006-01-08
窄屏简体版  字體: |||超大  

Network Working Group J. Franks

Request for Comments: 2617 Northwestern University

Obsoletes: 2069 P. Hallam-Baker

Category: Standards Track Verisign, Inc.

J. Hostetler

AbiSource, Inc.

S. Lawrence

Agranat Systems, Inc.

P. Leach

Microsoft Corporation

A. Luotonen

Netscape Communications Corporation

L. Stewart

Open Market, Inc.

June 1999

HTTP Authentication: Basic and Digest Access Authentication

备忘(Status of this Memo)

本文档跟踪记录Internet团体为完善协议而进行的讨论、建议。详情请参见官方文件(STD1)。本文可任意分发。

版权声明(Copyright Notice)

Copyright (C) The Internet Society (1999). All Rights Reserved.

摘要(Abstract)

“HTTP/1.0”中包括基本访问鉴别方案(Basic Access Authentication scheme)。该方案不是安全的用户授权方法(除非与其它安全方法联合使用,如SSL[5]),因为其用户名和口令在网络上是以明文方式传送的。

本文档还提供了HTTP鉴别框架的规范,有关原始的基本鉴别方案和基于哈希加密的方案的内容,请参见分类访问鉴别(Digest Acccess Authentication)。从RFC2069公布以来,其中涉及的一些可选元素因为出现问题而被移出;而还有一些新的元素因为兼容性的原因而被加入,这些新元素虽然是可选的,但还是强烈建议使用的,因而,RFC2069[6]最终可能会被本规范所替代。

Franks, et al. Standards Track [Page 1]

与基本方式类似的是,分类鉴别授权对通讯双方都知道的秘密(如口令)进行校验;而与基本方式不同的是,该校验方式中的口令不以明文方式传输,而这正是基本方式的最大弱点。正象其它大多数授权协议那样,该协议最大的风险不在于其协议本身,而是它周边的应用程序。

目录(Table of Contents)

1访问鉴别(Access Authentication)..................... ..................... ................................ 3

1.1 对HTTP/1.1规范的依赖(Reliance on the HTTP/1.1 Specification)............ 3

1.2访问鉴别框架(Access Authentication Framework)................. ..................... 3

2基本鉴别方案(Basic Authentication Scheme)........................ ............... ............... 5

3分类访问鉴别方案(Digest Access Authentication Scheme)............. ..................... 6

3.1介绍(Introduction)................................. ..................... ..................... ......... 6

3.1.1 目的(Purpose)...................................... ..................... ....................... 6

3.1.2 操作概述(Overall Operation)........................ ..................... ... ......... 6

3.1.3 分类值表示(Representation of digest values)............ ...................... 7

3.1.4 局限性(Limitations)................................... ..................... ................. 7

3.2分类标题规范(Specification of Digest Headers)................. ..................….. 7

3.2.1WWW-鉴别回应标题(The WWW-Authenticate Response Header).. 8

3.2.2 授权请求标题(The Authorization Request Header)....... ................... 11

3.2.3 鉴别信息标题(The Authentication-Info Header)....... ...................…. 15

3.3 分类操作(Digest Operation)........................... ..................... ..................... 17

3.4 安全协议商议(Security Protocol Negotiation).. ........................................ 18

3.5 例子(Example)...................................... ..................... ..................... ......…. 18

3.6 代理鉴别和代理授权(Proxy-Authentication and Proxy-Authorization).... 19

4 安全考虑(Security Considerations)............................ ..................... ...................….. 19

4.1使用基本鉴别方式的客户端鉴别(Authentication of Clients using Basic

Authentication).............................. ..................... ..................... ..................... 19

4.2使用分类鉴别方式的客户端鉴别(Authentication of Clients using Digest

Authentication).............................. ..................... ..................... ..................... 20

4.3使用有限制的nonce值(Limited Use Nonce Values)..................... .............. 21

4.4 用基本鉴别方式来进行分类比较(Comparison

of Digest with Basic Authentication).. ..................... ..................... .............. 22

4.5攻击回放(Replay Attacks).............................. ..................... ........................ 22

4.5 由多方鉴别方案产生的弱点(Weakness

Created by Multiple Authentication Schemes).................................. ............ 23

4.7在线字典攻击(Online dictionary attacks)...................... ..................... ....... 23

4.8中间人(Man in the Middle).............................. ..................... ..................... 24

4.9选择纯文本攻击(Chosen plaintext attacks)............... ..................... ............ 24

4.10用预先计算的字典攻击(Precomputed dictionary attacks)............... .......... 25

4.11批方式暴力攻击(Batch brute force attacks)...................... ........ .............. 25

4.12假冒服务器欺骗(Spoofing by Counterfeit Servers)............... ................... 25

4.13存储口令(Storing passwords)........................ ..................... ..................... 26

4.14摘要(Summary)................................ ..................... ..................... ............. 26

5例子实现(Sample implementation)....................... ..................... .......................... 27

6感谢(Acknowledgments).............................. ..................... ..................... .. ............. 31

Franks, et al. Standards Track [Page 2]

7参考书目(References)....................................... ..................... .............. ................ 31

8作者地址(Authors' Addresses)............................ ..................... ............................ 32

9完整版权状况(Full Copyright Statement)........................ ..................... .................. 34

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航