view release on metacpan or  search on metacpan

README  view on Meta::CPAN

5.3  Credential Format
----------------------

Credentials in Apache::SecSess have a similar format:

    URL Credentials:
        realm=E_k(md5(hash),hash)

    Cookie Credentials: 
        realm:qop,authqop=E_k(md5(hash),hash)

(The only difference is that the quality of protection parameters 
discussed below, qop and authqop, are repeated in the clear for cookie
credentials in order to ease processing.)

The string 'realm' is any symbol (without obvious special characters 
':', '=', etc) which is used to identify cooperating security services,
thus providing a way to put credentials into their own namespace.

The 'hash' is a string representation of a Perl hash of the form:

    hash = {
        uid => string: user ID
        timestamp => integer: time stamp from time(),
        qop => integer: session quality of protection,
        authqop => integer: user authentication quality of protection
    }

See the source code of Wrapper.pm for details of how the hash is converted 
into a string.

The encryption function E_k is currently not very configurable.  It is 
Rijndael (AES) in CBC mode with IV=0.  It is well known that CBC mode is 
vulnerable to forgeries, so a cryptographic checksum is prepended to the 
plaintext, as indicated.  

The secret key k must be shared by all host or web servers which use the same
realm.  Without the secret key, it should be cryptographically infeasible to 
produce credentials in which the hash and checksum match.  It should 
therefore be cryptographically infeasible for anyone to forge credentials or 
alter them in any way.


References
----------

[RFC2109] D. Kristol, L. Montulli, HTTP State Management Mechanism, 
    RFC 2109, 1997.

[RFC2964] K. Moore and N. Freed, Use of HTTP State Management
    RFC 2964, BCP 44, October 2000.

[RFC2965] D. Kristol, L. Montulli, HTTP State Management Mechanism, 
    RFC 2965 (Obsoletes 2109), October 2000.

[W3C] World Wide Web Consortium Security FAQ,
    URL: http://www.w3.org/Security/Faq/.

[SSL] D. Wagner, B. Schneier, "Analysis of the SSL 3.0 Protocol", 
    1996, URL: http://www.counterpane.com/ssl.html.