Subject: Re: I-D Action:draft-ietf-httpbis-security-properties-01.txt

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 13 Mar 2008 23:16:44 -0400

Now, regarding the touchy term "Web services", the draft currently
says, after a WS-bashing which seems to me a bit too personal for an
IETF document:

>  [[ This section could really use a good definition of "Web Services"
>   to differentiate it from REST. ]]

There is no clear and standard definition of "Web services". People
with suits often use it to refer to SOAP only. Other (like me) use it
for every technique layered on top of HTTP and XML, including
therefore REST.

A way to avoid any ambiguity would be not to use "Web services" at all
but the list "SOAP, XML-RPC and REST" which covers them all.

Since these three protocols use HTTP, they share many of the same
issues regarding security and therefore it is reasonable to treat them
together.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 13 Mar 2008 23:09:03 -0400

On Fri, Feb 22, 2008 at 09:58:34AM -0800,
 [email-masked] <[email-masked]> wrote 
 a message of 20 lines which said:

> 	Title           : Security Requirements for HTTP
> 	Author(s)       : P. Hoffman, A. Melnikov
> 	Filename        : draft-ietf-httpbis-security-properties-01.txt

This draft has a section on TLS, 2.5, which is quite short :-)

I suggest, after or before 2.2:

2.x TLS authentication

For the humans, long after form+cookies, TLS [RFC4346] is certainly
the most common way to authenticate a Web client. For the robots, this
technique is common, too.

Most actual deployments of client authenticatiuon use a custom PKI,
and user certificates directly distributed by this PKI. X509
hierarchies starting from a "widely known" CA are less common. For
instance, the tax submission system in France allowed last year X
[TODO: check the actual value] millions of users to submit their tax
data after authentication with a certificate delivered by the
governement.

And, in 2.5:

TLS, besides its use for client and/or server authentication, is also
very commonly used to protect the confidentiality and integrity of the
HTTP session. For instance, both HTTP Basic authentication and Cookies
are often protected against snooping by TLS.

It should be noted that, in that case, TLS does not protect against a
breach of the credential store at the server or against a keylogger or
phishing interface at the client. TLS does not change the fact that
Basic Authentication passwords are reusable and does not address that
weakness.

---

From: Robert Siemer <[email-masked]>
Date: Sat, 15 Mar 2008 22:15:16 +0100

> Basic Authentication passwords are reusable and does not address that

TLS does not address the security of the client certificate either 
(which can be stolen/copied from the client and is reusable...) But yes, 
there are better means to avoid that compared to passwords only (e.g. 
chipcards).

Robert

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 15 Mar 2008 16:51:09 -0700

>issues regarding security and therefore it is reasonable to treat them

In this context, "Web Services" is talking about the WS* stack. Are 
others OK with replacing "Web Services" with "SOAP and XML-RPC" in 
this section?

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 15 Mar 2008 16:49:33 -0700

I think both of these additions (with some edits) are a good way to 
acknowledge the use of client certificates for HTTP-over-TLS.

--Paul Hoffman

---

From: Martin Duerst <[email-masked]>
Date: Mon, 17 Mar 2008 12:54:49 +0900

>In this context, "Web Services" is talking about the WS* stack. Are others OK with replacing "Web Services" with "SOAP and XML-RPC" in this section?

For me, WS* clearly includes SOAP, but excludes XML-RPC.
But milage may vary.

Regards,   Martin.

#-#-#  Martin J. Du"rst, Assoc. Professor, Aoyama Gakuin University
#-#-#  http://www.sw.it.aoyama.ac.jp       mailto:[email-masked]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 17 Mar 2008 11:21:45 +0100

On Thu, Mar 13, 2008 at 11:09:03PM -0400,
 Stephane Bortzmeyer <[email-masked]> wrote 
 a message of 39 lines which said:

> For instance, the tax submission system in France allowed last year
> X [TODO: check the actual value] millions of users to submit their
> tax data after authentication with a certificate delivered by the
> governement.

3.7 millions
<http://www.impots.gouv.fr/portal/dgi/public;jsessionid=NUD43NNHB3KZDQFIEMQCFFWAVARXAIV1?paf_dm=popup&paf_gm=content&espId=1&typePage=cpr02&paf_gear_id=500018&docOid=documentstandard_4491>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 17 Mar 2008 11:34:46 +0100

On Sat, Mar 15, 2008 at 04:51:09PM -0700,
 Paul Hoffman <[email-masked]> wrote 

>> but the list "SOAP, XML-RPC and REST" which covers them all.
...
> In this context, "Web Services" is talking about the WS* stack. Are others 
> OK with replacing "Web Services" with "SOAP and XML-RPC" in this section?

Why excluding REST? As far as our subject (HTTP security) is
concerned, there is little difference between REST and (SOAP or
XML-RPC).