Module auth 

HTTP Digest authentication for SIP (RFC 7616, RFC 3261 §22).

Digest is where a stack quietly fails to interoperate. The formula is simple; the ways to get it wrong are not, and most of them produce a 401 loop rather than an error message:

• qop=auth changes the response formula. A server that offers it and a client that ignores it compute different digests from the same password.
• The -sess algorithms hash HA1 a second time with the nonces. Treating MD5-sess as MD5 is a one-word mistake that authenticates against nothing.
• The nonce count must increase, and must be eight lowercase hex digits. A server that tracks it will reject a repeat as a replay.
• The uri in the credentials is the Request-URI of the request being authorized, not the URI of the user. They differ for REGISTER, which is the first request anyone tries.

sipx supports MD5, MD5-sess, SHA-256 and SHA-256-sess. MD5 is not a defensible choice in 2026, but it is what deployed registrars offer, and refusing it would mean refusing to register. SHA-256 is preferred whenever the server offers it.

Structs

Challenge

A challenge from a WWW-Authenticate or Proxy-Authenticate header.

Credentials

What a user knows.

Enums

Algorithm

Which digest algorithm a challenge asks for.

Functions

respond

Answer a challenge.

strongest

Pick the strongest challenge offered, which is a deliberate departure from RFC 8760 §2.4.

topmost_supported

Pick the first challenge offered, which is RFC 8760 §2.4’s own rule.