Support HTTP digest authentication algorithm SHA-256 as per RFC-7617

[calvinbui]

Feature or enhancement

Proposal:

Support SHA-256 digest authentication following RFC7616 - https://datatracker.ietf.org/doc/html/rfc7616

CPython currently supports MD5 and SHA1 only.

Other possible methods include SHA-256-ness, SHA-512-256 and SHA-512-256-sess which hashlib doesn't currently appear to support out of the box.

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

Linked PRs

• gh-128192: support HTTP sha-256 digest authentication as per RFC-7617 #128193
• gh-128192: mark new tests with skips based on hashlib algorithm availability #128324

[rruuaanng]

I think we only need SHA256. That is say.

from RFC-7616

   This specification defines the following algorithms:

   o  SHA2-256 (mandatory to implement)

   o  SHA2-512/256 (as a backup algorithm)

   o  MD5 (for backward compatibility).

[picnixz]

We do support SHA-512-256 in hashlib if the underlying OpenSSL library implements it. This is the truncated SHA-2-512. This can be constructed via hashlib.new('SHA512_256') (other names are available, see https://docs.openssl.org/3.3/man7/EVP_MD-SHA2/#identities) (there is no dedicated constructor for this function though).

As for SHA-256-ness and SHA-512-sess are similar to SHA-256/512 and only differ in how A1 is computed (see https://datatracker.ietf.org/doc/html/rfc7616#section-3.4.2).

[picnixz]

@calvinbui If you're interested in the follow-up PR for tests and docs, we can keep the issue opened.

[gpshead]

I suggest just opening a new issue for test/doc improvements as those wouldn't strictly be related to this feature.