Subject: WGLC issue: token68 in p7

From: Ken Murchison <[email-masked]>
Date: Tue, 19 Mar 2013 09:59:19 -0400

Hi all,

Since the ABNF for token68 appears to only use "=" as padding for base64 
and base32 encoding, I would suggest changing

*"="

to

*6"="

since base64 requires no more than 2 padding chars and base32 requires 
no more than 6.

Regards,
Ken

-- 
Kenneth Murchison
Principal Systems Software Engineer
Carnegie Mellon University

---

From: Julian Reschke <[email-masked]>
Date: Tue, 19 Mar 2013 15:09:25 +0100

On 2013-03-19 14:59, Ken Murchison wrote:
> ...

We probably could. On the other hand, I'd like to avoid the impression 
that parsing per ABNF is sufficient to check validity of arguments; 
therefore, I'm reluctant to put even more information into the ABNF.

WDOT?

Best regards, Julian

---

From: Ken Murchison <[email-masked]>
Date: Tue, 19 Mar 2013 10:15:36 -0400

On 3/19/13 10:09 AM, Julian Reschke wrote:
> WDOT

Hi Julian,

If consensus is to leave it completely generic, I won't lose any sleep 
over it.

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 20 Mar 2013 01:36:33 +0100

>therefore, I'm reluctant to put even more information into the ABNF.

Since the exact number depends on the scheme, I see no reason to define
any maximum here, especially because they would have other constraints.
That said, right below the definition of token68 it would be useful to
have a reference to "Considerations for New Authentication Schemes" as
that explains why token68 exists (and I would probably allow the `=`
character anywhere in token68 instead of just the end if that is only
due to baseX constraints, precisely to avoid the impression that it is
baseX-specific rather than scheme-specific).
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: "Manger, James H" <[email-masked]>
Date: Wed, 20 Mar 2013 11:46:35 +1100

Björn,

'=' is only allowed at the end to ensure the syntax is unambiguous.
A token68 value can only be distinguished from an auth-param
(token = (token / quoted-string)) due to this restriction.

Let's keep token68 as it is.

--
James Manger

> -----Original Message-----
> From: Bjoern Hoehrmann [mailto:[email-masked]]
> Sent: Wednesday, 20 March 2013 11:37 AM
> To: Julian Reschke
> Cc: Ken Murchison; [email-masked]
> Subject: Re: WGLC issue: token68 in p7
> 
> * Julian Reschke wrote:
> >> Since the ABNF for token68 appears to only use "=" as padding for
> >> base64 and base32 encoding, I would suggest changing
> >>
> >> *"="
> >>
> >> to
> >>
> >> *6"="
> >>
> >> since base64 requires no more than 2 padding chars and base32
> >> requires no more than 6.
> >> ...
> >
> Björn Höhrmann · mailto:[email-masked] ·
> http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681
> · http://www.bjoernsworld.de

---

From: Julian Reschke <[email-masked]>
Date: Thu, 21 Mar 2013 08:32:36 +0100

> Let's keep token68 as it is.

As far as I can tell, if a given scheme always uses token68 (such as the 
Basic credentials), it's not necessary to be able to distinguish.

We added token68 for "Basic". Basic only needs token68 for credentials. 
Can somebody recall why we added it for challenges as well?

Best regards, Julian

---

From: Ken Murchison <[email-masked]>
Date: Thu, 21 Mar 2013 07:42:42 -0400

> Can somebody recall why we added it for challenges as well?

It looks like Bearer is the scheme that screwed this up by using chars 
outside of the base64 alphabet.

---

From: Amos Jeffries <[email-masked]>
Date: Fri, 22 Mar 2013 03:27:14 +1300

On 22/03/2013 12:42 a.m., Ken Murchison wrote:
>> As far as I can tell, if a given scheme always uses token68 (such as 
>> the Basic credentials), it's not necessary to be able to distinguish.
>>
>> We added token68 for "Basic". Basic only needs token68 for 
>> credentials. Can somebody recall why we added it for challenges as well?
>

Yes.
  Basic required base64 alphabet for response tokens.
  NTLM and Negotiate used that but required the tokens in both Request 
and Response.
  Bearer required extension characters to avoid base-64 encoding tokens 
that could come from weird systems like SAML and JSON with internal 
opaque format delimiters.

Amos

---

From: Ken Murchison <[email-masked]>
Date: Thu, 21 Mar 2013 10:42:34 -0400

At this point I agree with James, just leave it as is.

The auth scheme specs that use token68 (Basic, NTLM, Negotiate, Bearer) 
can further detail the content of token68 that is acceptable for the 
given scheme.

I withdraw my issue with token68 in p7.