I looked into this more, as far as I can tell the digests are sent in the cleartext, but a nonce is used to make replay attacks impossible even if someone is in the middle. Is that right?