Programming Jabber

Digest authentication method

The module that provides the digest authentication method, mod_auth_digest, works in conjunction with the plaintext module, mod_auth_plain. It provides a way to avoid having to send the plaintext password across the wire.

Method

The digest method is similar to the plaintext method, in that the password sent by the client is compared to the password stored on the server. However, in this case, the password is first encoded using a hashing algorithm. It is encoded by the client before being sent across the wire, and it is encoded by the server (having retrieved it in plaintext) before making the comparison.

The algorithm used is the NIST SHA-1 message digest algorithm.^[6]

This algorithm takes arbitrary input and produces a fingerprint or “message digest” of it.^[7]

A random string, shared between the client and the server, is appended to the password before being passed to the hashing algorithm. This random string is the connection ID—the value of the id attribute in the server’s XML stream header response that we saw in Example 7-3:

RECV: <?xml version='1.0'?>
<stream:stream xmlns:stream='http://etherx.jabber.org/streams'
  id='1ED34A55' xmlns='jabber:client' from='yak'>

which means, in the case where the password is “secret,” the string that will be hashed is:

secret1ED34A55

which is:

03ea09f012493415908d63dcb1f6dbdb9bfc09ba

The digested password is transmitted to the server inside the <digest/> tag.

mod_auth_digest is unlike the other two modules ...