5). DIGEST-MD5認證方式
DIGEST-MD5認證也是Challenge/Response的方式, 與CRAM-MD5相比, 它的Challenge信息更多, 其Response計算方式也非常複雜, 我在測試時也是以認證失敗而告終, 只是將在網上找到的資料整理於此, 能爲後來研究的人多提供點資料, 或者有興趣的朋友們可以和我一起討論下.
我們先看下DIGEST-MD5認證發送響應信息:
DIGEST-MD5服務器格式說明(見RFC 2831 Digest SASL Mechanism Mai 2000):
digest-challenge =
1 # (Reich | Nonce | qop-Optionen | schal | MAXBUF | charset
Algorithmus | Chiffre-opts | auth-param)
realm = "Reich" "=" < "> Reich-Wert <">
Reich-Wert = qdstr-val
Nonce = "Nonce" "=" < "> Nonce-Wert <">
Nonce-Wert = qdstr-val
qop-options = "qop" "=" < "> qop-Liste <">
qop-list = 1 # qop-Wert
qop-Wert = "auth" | "auth-int" | "auth-conf" |
Token
stale = "veraltete" "=" "true"
MAXBUF = "MAXBUF" "=" MAXBUF-Wert
MAXBUF-Wert = 1 * DIGIT
charset = "charset" = "" UTF-8 "
algorithm = "Algorithmus" "=" "md5-sess"
Chiffre-opts = "Chiffre" "=" < "> 1 # Null-Wert <">
Chiffre-value = "3des" | "des" | "RC4-40" | "RC4" |
"RC4-56" | Token
auth-param = Token "=" (token | quoted-string)
DIGEST-MD5客戶端響應格式說明(見RFC 2831 Digest SASL Mechanism Mai 2000):
digest-response = 1 # (Benutzername | Reich | Nonce | cnonce |
Nonce-count | qop | digest-uri | Antwort |
MAXBUF | charset | Chiffre | authzid |
auth-param)
username = "username" = "<"> username-Wert < ">
Benutzernamen-Wert = qdstr-val
cnonce = "cnonce" "=" < "> cnonce-Wert <">
cnonce-Wert = qdstr-val
Nonce-count = "nc" "=" nc-Wert
nc-Wert = 8LHEX
qop = "qop" "=" qop-Wert
digest-uri = "digest-uri" = "<"> digest-uri-value < ">
digest-uri-value = serv-type "/" host [ "/" serv-name] //eg: smtp/mail3.example.com/example.com
serv-type = 1 * ALPHA //www for web-service, ftp for ftp-dienst, SMTP for mail-versand-service …
host = 1 * (ALPHA | DIGIT | "-" | ".")
serv-name = host
response = "Antwort" "=" Response-Wert
response-value = 32LHEX
LHEX = "0" | "1" | "2" | "3" |
"4" | "5" | "6" | "7" |
"8" | "9" | "a" | "b" |
"c" | "d" | "e" | "f"
cipher = "Chiffre" "=" Null-Wert
authzid = "authzid" "=" < "> authzid-Wert <">
authzid-Wert = qdstr-val
其各字段具體含義見相關文檔, 這裏只介始幾個需要用到的字段是如何產生的, C/S響應示例如下:
S: realm="elwood.innosoft.com",nonce="OA6MG9tEQGm2hh",qop="auth",
algorithm=md5-sess,charset=utf-8
C: charset=utf-8,username="chris",realm="elwood.innosoft.com",
nonce="OA6MG9tEQGm2hh",nc=00000001,cnonce="OA6MHXh6VqTrRk",
digest-uri="imap/elwood.innosoft.com",
response=d388dad90d4bbd760a152321f2143af7,qop=auth
S: rspauth=ea40f60335c427b5527b84dbabcdfffd
The password in this example was "secret".
從這個示例可以看出, 客戶端返回的信息比服務器端發送過來的多了以下幾個:
username, nc, cnonce, digest-uri和respone
username就不用說了, nc是8位長的16進制數字符串,統計客戶端使用nonce發出請求的次數(包含當前請求),例示我們可以設爲”00000001”, cnonce是是用了4個隨機數組成一個8位長16進制的字符串,digest-uri是由在realm前加上請求類型(如http, smtp等), response是一個32位長的16進制數組, 計算公式如下:
If the "qop" value is "auth" or "auth-int":
request-digest = <"> < KD ( H(A1), unq(nonce-value)
":" nc-value
":" unq(cnonce-value)
":" unq(qop-value)
":" H(A2)
) <">
If the "qop" directive is not present (this construction is for
compatibility with RFC 2069):
request-digest =
<"> < KD ( H(A1), unq(nonce-value) ":" H(A2) ) >
<">
See below for the definitions for A1 and A2.
Read more: http://www.faqs.org/rfcs/rfc2617.html#ixzz0c4s8ck3F
KD(secret,data)表示分類算法,其中data指數據,secret表示採用的方法.如果表示校驗和算法時,data要寫成H(data);而unq(X)表示將帶引號字符串的引號去掉。
對於"MD5" 和"MD5-sess" 算法:
H(data) = MD5(data)
和
KD(secret, data) = H(concat(secret, ":", data))
如果"algorithm"指定爲"MD5"或沒有指定,A1計算方式如下:
A1 = unq(username-value) ":" unq(realm-value) ":" passwd
//Password爲用戶密碼
如果"algorithm"指定爲"MD5-sess", 則需要nonce和cnonce的參與:
A1 = H(unq(username-value) ":" unq(realm-value) ":" passwd )
":" unq(nonce-value) ":" unq(cnonce-value)
如果"qop"沒有指定或指定爲"auth", A2計算方式如下:
A2 = Method ":" digest-uri-value
如果"qop"沒有指定或指定爲"auth int", A2計算方式如下:
A2 = Method ":" digest-uri-value ":" H(entity-body)
Method是http請求時的方法(post,get), 由於英文水平比較差, 很多都看不明白, 有興趣的朋友可以自己去看看原文(http://www.faqs.org/rfcs/rfc2617.html), 這裏還提供了DIGEST驗證的代碼:
File "digcalc.h":
#define HASHLEN 16
typedef char HASH[HASHLEN];
#define HASHHEXLEN 32
typedef char HASHHEX[HASHHEXLEN+1];
#define IN
#define OUT
/* calculate H(A1) as per HTTP Digest spec */
void DigestCalcHA1(
IN char * pszAlg,
IN char * pszUserName,
IN char * pszRealm,
IN char * pszPassword,
IN char * pszNonce,
IN char * pszCNonce,
OUT HASHHEX SessionKey
);
/* calculate request-digest/response-digest as per HTTP Digest spec */
void DigestCalcResponse(
IN HASHHEX HA1, /* H(A1) */
IN char * pszNonce, /* nonce from server */
IN char * pszNonceCount, /* 8 hex digits */
IN char * pszCNonce, /* client nonce */
IN char * pszQop, /* qop-value: "", "auth", "auth-int" */
IN char * pszMethod, /* method from the request */
IN char * pszDigestUri, /* requested URL */
IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */
OUT HASHHEX Response /* request-digest or response-digest */
);
File "digcalc.c":
#include <global.h>
#include <md5.h>
#include <string.h>
#include "digcalc.h"
void CvtHex(
IN HASH Bin,
OUT HASHHEX Hex
)
{
unsigned short i;
unsigned char j;
for (i = 0; i < HASHLEN; i++) {
j = (Bin[i] >> 4) & 0xf;
if (j <= 9)
Hex[i*2] = (j + '0');
else
Hex[i*2] = (j + 'a' - 10);
j = Bin[i] & 0xf;
if (j <= 9)
Hex[i*2+1] = (j + '0');
else
Hex[i*2+1] = (j + 'a' - 10);
};
Hex[HASHHEXLEN] = '/0';
};
/* calculate H(A1) as per spec */
void DigestCalcHA1(
IN char * pszAlg,
IN char * pszUserName,
IN char * pszRealm,
IN char * pszPassword,
IN char * pszNonce,
IN char * pszCNonce,
OUT HASHHEX SessionKey
)
{
MD5_CTX Md5Ctx;
HASH HA1;
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, pszUserName, strlen(pszUserName));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszRealm, strlen(pszRealm));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszPassword, strlen(pszPassword));
MD5Final(HA1, &Md5Ctx);
if (stricmp(pszAlg, "md5-sess") == 0) {
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, HA1, HASHLEN);
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
MD5Final(HA1, &Md5Ctx);
};
CvtHex(HA1, SessionKey);
};
/* calculate request-digest/response-digest as per HTTP Digest spec */
void DigestCalcResponse(
IN HASHHEX HA1, /* H(A1) */
IN char * pszNonce, /* nonce from server */
IN char * pszNonceCount, /* 8 hex digits */
IN char * pszCNonce, /* client nonce */
IN char * pszQop, /* qop-value: "", "auth", "auth-int" */
IN char * pszMethod, /* method from the request */
IN char * pszDigestUri, /* requested URL */
IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */
OUT HASHHEX Response /* request-digest or response-digest */
)
{
MD5_CTX Md5Ctx;
HASH HA2;
HASH RespHash;
HASHHEX HA2Hex;
// calculate H(A2)
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, pszMethod, strlen(pszMethod));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszDigestUri, strlen(pszDigestUri));
if (stricmp(pszQop, "auth-int") == 0) {
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, HEntity, HASHHEXLEN);
};
MD5Final(HA2, &Md5Ctx);
CvtHex(HA2, HA2Hex);
// calculate response
MD5Init(&Md5Ctx);
MD5Update(&Md5Ctx, HA1, HASHHEXLEN);
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszNonce, strlen(pszNonce));
MD5Update(&Md5Ctx, ":", 1);
if (*pszQop) {
MD5Update(&Md5Ctx, pszNonceCount, strlen(pszNonceCount));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));
MD5Update(&Md5Ctx, ":", 1);
MD5Update(&Md5Ctx, pszQop, strlen(pszQop));
MD5Update(&Md5Ctx, ":", 1);
};
MD5Update(&Md5Ctx, HA2Hex, HASHHEXLEN);
MD5Final(RespHash, &Md5Ctx);
CvtHex(RespHash, Response);
};
File "digtest.c":
#include <stdio.h>
#include "digcalc.h"
void main(int argc, char ** argv) {
char * pszNonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093";
char * pszCNonce = "0a4f113b";
char * pszUser = "Mufasa";
char * pszRealm = "[email protected]";
char * pszPass = "Circle Of Life";
char * pszAlg = "md5";
char szNonceCount[9] = "00000001";
char * pszMethod = "GET";
char * pszQop = "auth";
char * pszURI = "/dir/index.html";
HASHHEX HA1;
HASHHEX HA2 = "";
HASHHEX Response;
DigestCalcHA1(pszAlg, pszUser, pszRealm, pszPass, pszNonce,
pszCNonce, HA1);
DigestCalcResponse(HA1, pszNonce, szNonceCount, pszCNonce, pszQop,
pszMethod, pszURI, HA2, Response);
printf("Response = %s/n", Response);
};
到這裏,關於使用SMTP發送mail就結束了, 由於水平有限, 有很多地方可能講不夠透徹!!!
利用SMTP發送Mail詳解(三)
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.