Digest access authentication is one of the agreed-upon methods a web server can use to negotiate credentials, such as username or password, with a user's web browser. This can be used to confirm the identity of a user before sending sensitive information, such as online banking transaction history. It applies a hash function to the username and password before sending them over the network. In contrast, basic access authentication uses the easily reversible Base64 encoding instead of hashing, making it non-secure unless used in conjunction with TLS. Technically, digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol. Overview Digest access authentication was originally specified by RFC 2069 (An Extension to HTTP: Digest Access Authentication). RFC 2069 specifies roughly a traditional digest authentication scheme with security maintained by a server-generated nonce value. The authentication response is formed as follows (where HA1 and HA2 are names of string variables): HA1 = MD5(username:realm:password) HA2 = MD5(method:digestURI) response = MD5(HA1:nonce:HA2) An MD5 hash is a 16-byte value. The HA1 and HA2 values used in the computation of the response are the hexadecimal representation (in lowercase) of the MD5 hashes respectively. RFC 2069 was later replaced by RFC 2617 (HTTP Authentication: Basic and Digest Access Authentication). RFC 2617 introduced a number of optional security enhancements to digest authentication; "quality of protection" (qop), nonce counter incremented by client, and a client-generated random nonce. These enhancements are designed to protect against, for example, chosen-plaintext attack cryptanalysis. If the algorithm directive's value is "MD5" or unspecified, then HA1 is HA1 = MD5(username:realm:password) If the algorithm directive's value is "MD5-sess", then HA1 is HA1 = MD5(MD5(username:realm:password):nonce:cnonce) If the qop directive's value is "auth" or is unspecified, then HA2 is HA2 = MD5(method:digestURI) If the qop directive's value is "auth-int", then HA2 is HA2 = MD5(method:digestURI:MD5(entityBody)) If the qop directive's value is "auth" or "auth-int", then compute the response as follows: response = MD5(HA1:nonce:nonceCount:cnonce:qop:HA2) If the qop directive is unspecified, then compute the response as follows: response = MD5(HA1:nonce:HA2) The above shows that when qop is not specified, the simpler RFC 2069 standard is followed. In September 2015, RFC 7616 replaced RFC 2617 by adding 4 new algorithms: "SHA-256", "SHA-256-sess", "SHA-512-256" and "SHA-512-256-sess". The encoding is equivalent to "MD5" and "MD5-sess" algorithms, with MD5 hashing function replaced with SHA-256 and SHA-512-256. However, as of July 2021,