Robert Sayre wrote:
It's not a very convincing argument, but it's not the argument one would make against Digest. Digest requires storing a password, not a password hash.
Are you sure? I would have thought you could precompute the user/realm/password hash and just store that. For the MD5 algorithm that essentially gives you H(A1). For MD5-sess you combine it with the server and client nonce values to get A1.
Actually, looking at RFC2617 it basically says as much: "Because the server need only use the hash of the user credentials in order to create the A1 value, this construction could be used in conjunction with a third party authentication service so that the web server would not need the actual password value."
Not that it really matters. If you all think TLS is essential I'm not going to continue arguing against it.
Regards James
