digest_auth.nx

digest_auth.nx -- HTTP Digest authentication response builder. RFC 7616 / RFC 2617. Stronger than Basic auth (password not transmitted) but still obsolete compared to bearer tokens + TLS. Interop reality: many IP cameras, routers, printers, legacy enterprise apps, and Microsoft IIS sites use Digest. Challenge format (server -> client, 401 response): WWW-Authenticate: Digest realm=\"Protected\", nonce=\"abc123\", qop=\"auth\", algorithm=MD5 Response format (client -> server): Authorization: Digest username=\"alice\", realm=\"Protected\", nonce=\"abc123\", uri=\"/admin\", qop=auth, nc=00000001, cnonce=\"xyz789\", response=\"<hash>\", algorithm=MD5 Response hash (RFC 7616 §3.4.1 for qop=auth): HA1 = MD5(username : realm : password) HA2 = MD5(method : uri) response = MD5(HA1 : nonce : nc : cnonce : qop : HA2) We compute the `response` value + emit the full Authorization header value. Challenge-parsing is a separate job; this module assumes caller extracted realm/nonce/qop from the WWW- Authenticate header already. Composes md5.nx + hex.nx. Invariants: D1 HA1/HA2/response all emitted as 32 lowercase hex chars. D2 Currently supports qop=auth + algorithm=MD5 only. SHA-256 variant (RFC 7616) is a future extension composing sha256. D3 cnonce + nc counter are caller-supplied -- the module doesn't generate them (entropy + state are caller's concern).