RFC 3310

Q: What does the Introduction section cover in RFC 3310 — HTTP Digest AKA?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 3310 — HTTP Digest AKA. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the AKA Parameter Mapping section cover in RFC 3310 — HTTP Digest AKA?

The AKA Parameter Mapping section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 3310 — HTTP Digest AKA. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the IMS Authentication Flow section cover in RFC 3310 — HTTP Digest AKA?

The IMS Authentication Flow section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 3310 — HTTP Digest AKA. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 3310 — HTTP Digest AKA?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 3310 — HTTP Digest AKA. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA)

Informational

September 2002

Abstract: This document specifies how to use the 3GPP AKA mechanism within the HTTP Digest authentication framework. This mapping enables SIP/IMS authentication using AKA challenge-response parameters transported in HTTP Digest headers.

Canonical source: https://www.rfc-editor.org/rfc/rfc3310 | IETF Datatracker

1. Introduction

▶

RFC 3310 maps the 3GPP AKA mutual authentication mechanism into the HTTP Digest authentication framework (RFC 2617). This is primarily used in the IP Multimedia Subsystem (IMS) for SIP REGISTER authentication between the UE and the S-CSCF (via P-CSCF).

2. AKA Parameter Mapping

▶

AKA parameters are encoded into the HTTP Digest challenge and response fields:

HTTP Digest Field	AKA Parameter	Description
nonce	RAND \|\| AUTN (base64)	Encodes both challenge and authentication token
response	RES	Response computed by USIM
algorithm	AKAv1-MD5 or AKAv2-SHA-256	Identifies AKA version and hash function
qop	auth / auth-int	Quality of protection level

3. IMS Authentication Flow

▶

  UE                P-CSCF              S-CSCF              HSS
|                  |                   |                   |
|  SIP REGISTER    |                   |                   |
|----------------->|------------------>|  Cx: MAR          |
|                  |                   |------------------>|
|                  |                   |  Cx: MAA          |
|                  |                   |  (RAND,AUTN,XRES) |
|                  |                   |<------------------|
|                  |  401 Unauthorized  |                   |
|                  |  WWW-Authenticate: |                   |
|                  |  Digest nonce=     |                   |
|                  |  base64(RAND||AUTN)|                   |
|  401 Unauthorized|<------------------|                   |
|<-----------------|                   |                   |
|                  |                   |                   |
|  Verify AUTN     |                   |                   |
|  Compute RES     |                   |                   |
|                  |                   |                   |
|  SIP REGISTER    |                   |                   |
|  Authorization:  |                   |                   |
|  Digest response=|                   |                   |
|  RES             |                   |                   |
|----------------->|------------------>|  Verify RES==XRES |
|                  |  200 OK           |                   |
|  200 OK          |<------------------|                   |
|<-----------------|                   |                   |

4. Security Considerations

▶

Mutual authentication: AUTN verification by UE provides network authentication; RES verification provides subscriber authentication
Replay protection: AKA SQN prevents replay of authentication vectors
Confidentiality: AKA provides key agreement (CK, IK) for subsequent IPsec SA setup in IMS
Digest limitations: HTTP Digest itself uses MD5/SHA-256 for response hashing — weaker than EAP-AKA' methods