1-- Id
2
3DIGEST DEFINITIONS ::=
4BEGIN
5
6IMPORTS EncryptedData, Principal FROM krb5;
7
8DigestTypes ::= BIT STRING {
9          ntlm-v1(0),
10          ntlm-v1-session(1),
11          ntlm-v2(2),
12          digest-md5(3),
13          chap-md5(4),
14          ms-chap-v2(5)
15}
16
17DigestInit ::= SEQUENCE {
18    type            UTF8String, -- http, sasl, chap, cram-md5 --
19    channel                   [0] SEQUENCE {
20          cb-type             UTF8String,
21          cb-binding          UTF8String
22    } OPTIONAL,
23    hostname                  [1] UTF8String OPTIONAL -- for chap/cram-md5
24}
25
26DigestInitReply ::= SEQUENCE {
27    nonce           UTF8String,         -- service nonce/challenge
28    opaque                    UTF8String,         -- server state
29    identifier                [0] UTF8String OPTIONAL
30}
31
32
33DigestRequest ::= SEQUENCE  {
34    type            UTF8String, -- http, sasl-md5, chap, cram-md5 --
35    digest                    UTF8String, -- http:md5/md5-sess sasl:clear/int/conf --
36    username                  UTF8String, -- username user used
37    responseData    UTF8String, -- client response
38    authid                    [0] UTF8String OPTIONAL,
39    authentication-user       [1] Principal OPTIONAL, -- principal to get key from
40    realm           [2] UTF8String OPTIONAL,
41    method                    [3] UTF8String OPTIONAL,
42    uri                       [4] UTF8String OPTIONAL,
43    serverNonce               UTF8String, -- same as "DigestInitReply.nonce"
44    clientNonce               [5] UTF8String OPTIONAL,
45    nonceCount                [6] UTF8String OPTIONAL,
46    qop                       [7] UTF8String OPTIONAL,
47    identifier                [8] UTF8String OPTIONAL,
48    hostname                  [9] UTF8String OPTIONAL,
49    opaque                    UTF8String -- same as "DigestInitReply.opaque"
50}
51-- opaque = hex(cksum(type|serverNonce|identifier|hostname,digest-key))
52-- serverNonce = hex(time[4bytes]random[12bytes])(-cbType:cbBinding)
53
54
55DigestError ::= SEQUENCE {
56    reason                    UTF8String,
57    code            INTEGER (-2147483648..2147483647)
58}
59
60DigestResponse ::= SEQUENCE  {
61    success                   BOOLEAN,
62    rsp                       [0] UTF8String OPTIONAL,
63    tickets                   [1] SEQUENCE OF OCTET STRING OPTIONAL,
64    channel                   [2] SEQUENCE {
65          cb-type             UTF8String,
66          cb-binding          UTF8String
67    } OPTIONAL,
68    session-key               [3] OCTET STRING OPTIONAL
69}
70
71NTLMInit ::= SEQUENCE {
72    flags           [0] INTEGER (0..4294967295),
73    hostname                  [1] UTF8String OPTIONAL,
74    domain                    [1] UTF8String OPTIONAL
75}
76
77NTLMInitReply ::= SEQUENCE {
78    flags           [0] INTEGER (0..4294967295),
79    opaque                    [1] OCTET STRING,
80    targetname                [2] UTF8String,
81    challenge                 [3] OCTET STRING,
82    targetinfo                [4] OCTET STRING OPTIONAL
83}
84
85NTLMRequest ::= SEQUENCE {
86    flags           [0] INTEGER (0..4294967295),
87    opaque                    [1] OCTET STRING,
88    username                  [2] UTF8String,
89    targetname                [3] UTF8String,
90    targetinfo                [4] OCTET STRING OPTIONAL,
91    lm                        [5] OCTET STRING,
92    ntlm            [6] OCTET STRING,
93    sessionkey                [7] OCTET STRING OPTIONAL
94}
95
96NTLMResponse ::= SEQUENCE {
97    success                   [0] BOOLEAN,
98    flags           [1] INTEGER (0..4294967295),
99    sessionkey                [2] OCTET STRING OPTIONAL,
100    tickets                   [3] SEQUENCE OF OCTET STRING OPTIONAL
101}
102
103NTLMRequest2 ::= SEQUENCE {
104    loginUserName   [0] UTF8String,
105    loginDomainName [1] UTF8String,
106    flags           [2] INTEGER (0..4294967295),
107    lmchallenge               [3] OCTET STRING SIZE (8),
108    ntChallengeResponce [4] OCTET STRING,
109    lmChallengeResponce [5] OCTET STRING
110}
111
112NTLMReply ::= SEQUENCE {
113    success                   [0] BOOLEAN,
114    flags           [1] INTEGER (0..4294967295),
115    sessionkey                [2] OCTET STRING OPTIONAL
116}
117
118DigestReqInner ::= CHOICE {
119    init            [0] DigestInit,
120    digestRequest   [1] DigestRequest,
121    ntlmInit                  [2] NTLMInit,
122    ntlmRequest               [3] NTLMRequest,
123    supportedMechs  [4] NULL
124}
125
126DigestREQ ::= [APPLICATION 128] SEQUENCE {
127    apReq           [0] OCTET STRING,
128    innerReq                  [1] EncryptedData
129}
130
131DigestRepInner ::= CHOICE {
132    error           [0] DigestError,
133    initReply                 [1] DigestInitReply,
134    response                  [2] DigestResponse,
135    ntlmInitReply   [3] NTLMInitReply,
136    ntlmResponse    [4] NTLMResponse,
137    supportedMechs  [5] DigestTypes,
138    ...
139}
140
141DigestREP ::= [APPLICATION 129] SEQUENCE {
142    apRep           [0] OCTET STRING,
143    innerRep                  [1] EncryptedData
144}
145
146
147-- HTTP
148
149-- md5
150-- A1 = unq(username-value) ":" unq(realm-value) ":" passwd
151-- md5-sess
152-- A1 = HEX(H(unq(username-value) ":" unq(realm-value) ":" passwd ) ":" unq(nonce-value) ":" unq(cnonce-value))
153
154-- qop == auth
155-- A2 = Method ":" digest-uri-value
156-- qop == auth-int
157-- A2 = Method ":" digest-uri-value ":" H(entity-body)
158
159-- request-digest  = HEX(KD(HEX(H(A1)),
160--    unq(nonce-value) ":" nc-value ":" unq(cnonce-value) ":" unq(qop-value) ":" HEX(H(A2))))
161-- no "qop"
162-- request-digest  = HEX(KD(HEX(H(A1)), unq(nonce-value) ":" HEX(H(A2))))
163
164
165-- SASL:
166-- SS = H( { unq(username-value), ":", unq(realm-value), ":", password } )
167-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value) }
168-- A1 = { SS, ":", unq(nonce-value), ":", unq(cnonce-value), ":", unq(authzid-value) }
169
170-- A2 = "AUTHENTICATE:", ":", digest-uri-value
171-- qop == auth-int,auth-conf
172-- A2 = "AUTHENTICATE:", ":", digest-uri-value, ":00000000000000000000000000000000"
173
174-- response-value = HEX( KD ( HEX(H(A1)),
175--                 { unq(nonce-value), ":" nc-value, ":",
176--                   unq(cnonce-value), ":", qop-value, ":",
177--                   HEX(H(A2)) }))
178
179END
180