<div dir="ltr"><div dir="ltr"><div dir="auto">Whoever works on this needs to consider two things I think:<div dir="auto"><br></div><div dir="auto">- ability to select algorithms when challenging UAC (MD5-only, SHA256-only, <span style="color:rgb(0,0,0);font-size:13.3333px">SHA-512/256-only, all permutations</span>).
The RFC allows UAS to include multiple HFs(*).
MD5-only should probably be the default. I suspect there might be a significantly non-trivial population of UACs that would get confused receiving multiple digests.
Plus enabling challenges for all protocols would expand the size of 401s messages. </div><div dir="auto"><br></div><div dir="auto">- ability to accept response in either of supported hashing methods or any combination of thereof. The reasonable default here is probably MD5-only for now, again to prevent the possibility of foul play when we only request MD5, while for some reason getting say SHA-256 back.</div><div dir="auto"><br></div><div>-Max</div><div><pre class="gmail-newpage" style="font-size:13.3333px;margin-top:0px;margin-bottom:0px;break-before:page;color:rgb(0,0,0)">*) Example:</pre><pre class="gmail-newpage" style="font-size:13.3333px;margin-top:0px;margin-bottom:0px;break-before:page;color:rgb(0,0,0)">401 Unauthorized</pre><pre class="gmail-newpage" style="font-size:13.3333px;margin-top:0px;margin-bottom:0px;break-before:page;color:rgb(0,0,0)">[..]
WWW-Authenticate: Digest
realm="<a href="mailto:http-auth@example.org">http-auth@example.org</a>",
qop="auth, auth-int",
algorithm=SHA-256,
nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS"
WWW-Authenticate: Digest
realm="<a href="mailto:http-auth@example.org">http-auth@example.org</a>",
qop="auth, auth-int",
algorithm=MD5,
nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS"
</pre><br class="gmail-Apple-interchange-newline"></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue., Jun. 16, 2020, 12:13 p.m. Aymeric Moizard, <<a href="mailto:amoizard@gmail.com" target="_blank">amoizard@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mar. 16 juin 2020 à 20:42, Henning Westerholt <<a href="mailto:hw@skalatan.de" rel="noreferrer" target="_blank">hw@skalatan.de</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="DE">
<div>
<p class="MsoNormal"><span>Hello,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">take a look to this parameter, you can switch between MD5 and SHA256, but only use once at a time:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><a href="https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorithm" rel="noreferrer" target="_blank">https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorithm</a>
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">About planned features – I am not aware of major extensions in this module. Of course, any contribution is welcome.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u></span></p></div></div></blockquote><div><br></div><div>Thanks for your answer.</div><div>If I have some time, I might try to make a PR on being able to select the algorithm at runtime.</div><div><br></div><div>Regards,</div><div>Aymeric</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="DE"><div><p class="MsoNormal"><span lang="EN-GB"> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Cheers,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">-- <u></u>
<u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning Westerholt –
</span><span><a href="https://skalatan.de/blog/" rel="noreferrer" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://skalatan.de/blog/</span></a></span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Kamailio services –
</span><span><a href="https://gilawa.com/" rel="noreferrer" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://gilawa.com</span></a></span><span>
<span lang="EN-GB"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <<a href="mailto:sr-users-bounces@lists.kamailio.org" rel="noreferrer" target="_blank">sr-users-bounces@lists.kamailio.org</a>>
<b>On Behalf Of </b>Aymeric Moizard<br>
<b>Sent:</b> Monday, June 15, 2020 10:31 PM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" rel="noreferrer" target="_blank">sr-users@lists.kamailio.org</a>><br>
<b>Subject:</b> [SR-Users] MD5 and SHA-256 instead of MD5 or SHA-256...<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hi All,<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I'd like to improve my setup by switching to SHA-256. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">However, as a first step, I would like to offer both MD5 and SHA-256<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">in 2 different WWW-Authenticate header.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">If I'm correct, this is not doable with the latest auth module?<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Is this a planned feature?<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">As an alternative, I would like to decide the algorithm in the script<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">instead of a module parameter. It looks to me this is also not doable?<u></u><u></u></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Again, is this a planned feature?<u></u><u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Thanks to all,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Regards<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Aymeric<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">-- <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><img border="0" width="48" height="48" style="width: 0.5in; height: 0.5in;" id="gmail-m_8869182984838928819m_3767161181713272614gmail-m_-1831920577507351277_x0000_i1025" src="http://sip.antisip.com/am48.png">Antisip -
<a href="http://www.antisip.com" rel="noreferrer" target="_blank">http://www.antisip.com</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><img src="http://sip.antisip.com/am48.png">Antisip - <a href="http://www.antisip.com" rel="noreferrer" target="_blank">http://www.antisip.com</a><br></div></div>
_______________________________________________<br>
Kamailio (SER) - Users Mailing List<br>
<a href="mailto:sr-users@lists.kamailio.org" rel="noreferrer" target="_blank">sr-users@lists.kamailio.org</a><br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div>
</div>