RFC 4169: Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2
In plain English — editorial summary, not part of the RFC
HTTP Digest, as specified in RFC 2617, is known to be vulnerable to man-in-the-middle attacks if the client fails to authenticate the server in TLS, or if the same passwords are used for authentication in some other context without TLS. This is a general problem that exists not just with HTTP Digest, but also with other IETF protocols that use tunneled authentication. This document specifies version 2 of the HTTP Digest AKA algorithm (RFC 3310). This algorithm can be implemented in a way that it is resistant to the man-in-the-middle attack. This memo provides information for the Internet community.
Document record
- Document ID
- RFC4169
- Published
- November 2005
- Authors
- V. Torvinen; J. Arkko; M. Naslund
- Status
- INFORMATIONAL
- Stream
- IETF
- Area
- —
- Pages
- 13
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 3749Transport Layer Security Protocol Compression MethodsUpdated
May 2004
- RFC 3734Extensible Provisioning Protocol (EPP) Transport Over TCPObsoleted
March 2004
- RFC 3546Transport Layer Security (TLS) ExtensionsObsoleted
June 2003
- RFC 3436Transport Layer Security over Stream Control Transmission ProtocolUpdated
December 2002
- RFC 4934Extensible Provisioning Protocol (EPP) Transport Over TCPObsoleted
May 2007
- RFC 5018Connection Establishment in the Binary Floor Control Protocol (BFCP)Updated
September 2007
- RFC 3268Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)Obsoleted
July 2002
- RFC 2817Upgrading to TLS Within HTTP/1.1Updated
May 2000
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?