You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2019/03/09 08:41:06 UTC

[Bug 63250] New: In Apache Httpd Server, htdigest uses the insecure MD5 encryption mode to encrypt the security information (password). Is it reasonable?

https://bz.apache.org/bugzilla/show_bug.cgi?id=63250

            Bug ID: 63250
           Summary: In Apache Httpd Server, htdigest uses the insecure MD5
                    encryption mode to encrypt the security information
                    (password). Is it reasonable?
           Product: Apache httpd-2
           Version: 2.4.34
          Hardware: All
                OS: All
            Status: NEW
          Severity: minor
          Priority: P2
         Component: support
          Assignee: bugs@httpd.apache.org
          Reporter: zhangle2005@vip.qq.com
  Target Milestone: ---

In Apache Httpd Server, htdigest uses the insecure MD5 encryption mode to
encrypt the security information (password). Is it reasonable? Can add other
encryption modes for selection?

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 63250] In Apache Httpd Server, htdigest uses the insecure MD5 encryption mode to encrypt the security information (password). Is it reasonable?

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63250

Stefan Eissing <st...@eissing.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #1 from Stefan Eissing <st...@eissing.org> ---
HTTP digest authentication is a IETF standard
<https://www.ietf.org/rfc/rfc2617.txt>. If you like to come up with a successor
to that, please engage in the HTTP working group.

Once standardized, we will certainly be eager to implement that.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org