Subject: Re: Call for adoption: draft-reschke-httpauth-auth-info-00

From: Bjoern Hoehrmann <[email-masked]>
Date: Sun, 01 Feb 2015 10:00:32 +0100

* Mark Nottingham wrote:
>Julian has proposed that 
><http://tools.ietf.org/html/draft-reschke-httpauth-auth-info-00> be 
>adopted by this WG, with the aim of getting to LC quickly so that it can 
>be referenced by other efforts.

There is basically no information in the draft what the header can,
should, or should not be used for, it does not even indicate what the
`Digest` scheme uses it for, and it does not point out caveats like
poor interaction with pipelined requests as they are noted in RFC 2617
and whether such considerations apply to HTTP/2, for instance. I guess
that can be addressed, but it would not have hurt to let the `-00` draft
go through a round of feedback before calling for adoption.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Sun, 01 Feb 2015 18:23:26 +0100

> `Digest` scheme uses it for, and it does not point out caveats like

The latter is supposed to be in the DIGEST spec.

Do you have a proposal for the former?

> and whether such considerations apply to HTTP/2, for instance. I guess

Again, that seems to be specific to the nextnonce parameter which is 
specific to DIGEST.

> go through a round of feedback before calling for adoption.

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 02 Feb 2015 02:41:02 +0100

>Again, that seems to be specific to the nextnonce parameter which is 

A possible starting point would be to explain whether, how, and why it
is better to use an authentication scheme independent header to specify
authentication scheme specific parameters. If it's pretty much always
better to use `Authentication-Info` then there probably should be some
SHOULD-level requirement to use it somewhere.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 2 Feb 2015 16:17:08 +1100

I haven't seen pushback on adopting this draft (although people have started to raise issues, which is good), so we'll do so.

Julian, you'll continue to edit the document. Please bring the work to <https://github.com/httpwg/http-extensions>; I've already created a label in the issues list for it.

Cheers,

> On 29 Jan 2015, at 9:45 am, Mark Nottingham <[email-masked]> wrote:
> 
> Julian has proposed that <http://tools.ietf.org/html/draft-reschke-httpauth-auth-info-00> be adopted by this WG, with the aim of getting to LC quickly so that it can be referenced by other efforts.
> 
> I've discussed it with Barry and he agrees that it's a reasonable thing for us to do.
> 
> Please discuss; we'll make a decision about adoption on 1 Feb 2015.
> 
> Regards,
> 
> 
> --
> Mark Nottingham   https://www.mnot.net/
> 
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 02 Feb 2015 14:41:47 +0100

On 2015-01-30 22:45, Amos Jeffries wrote:
> On 31/01/2015 3:11 a.m., Rifaat Shekh-Yusef wrote:
>> Why would we restrict the use of this header in future protocols based on
>> the Digest usage of this header?
>> What would be the harm in allowing the new protocol that uses the header to
>> restrict it usage?
>>
>
> Information leaks. User credentials and secure token are potentially
> stored in here, as are details specific to the internal operation of the
> security algorithm selected/negotiated.
> ...

The intent of the draft was to separate out what was defined in RFC 
2617; thus I agree that we shouldn't relax the use unless there's broad 
consensus that that would be a good idea.

Best regards, Julian

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 2 Feb 2015 09:08:44 -0500

This document does not define any semantics associated with these header,
which means that the document that uses these header will be the one that
must address the information leak issue.
I do not see why we would restrict a future use of these headers based on
the Digest usage; this seems odd to me.

Regards,
 Rifaat

On Mon, Feb 2, 2015 at 8:41 AM, Julian Reschke <[email-masked]>
wrote:

> The intent of the draft was to separate out what was defined in RFC 2617;
> thus I agree that we shouldn't relax the use unless there's broad consensus
> that that would be a good idea.
>
> Best regards, Julian
>
>

---

From: Julian Reschke <[email-masked]>
Date: Wed, 04 Feb 2015 17:46:52 +0100

On 2015-02-02 15:08, Rifaat Shekh-Yusef wrote:
> This document does not define any semantics associated with these
> header, which means that the document that uses these header will be the
> one that must address the information leak issue.
> I do not see why we would restrict a future use of these headers based
> on the Digest usage; this seems odd to me.
>
> Regards,
>   Rifaat

Well, the goal for me was not to define anything new, but just to 
extract what we have already into something that can be maintained 
separately from DIGEST. As such, Hervé's comment made sense to me, and I 
updated the editor's copy accordingly:

<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-auth-info-latest-from-previous.diff.html>

Maybe other potential users of Auth-Info (Yutaka & Alexey) could state 
whether having this constraint would affect their ability to use 
Authentication-Info?

Assuming that is not the case, I'd like to declare victory, submit a new 
draft, and ask Mark to start a WGLC...

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Fri, 06 Feb 2015 11:01:23 +0100

> draft, and ask Mark to start a WGLC...

Seeing no additional feedback, I went ahead and submitted draft 01.

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 06 Feb 2015 15:46:26 +0000

> Seeing no additional feedback, I went ahead and submitted draft 01.
I think your definition would work for the SCRAM draft.

---

From: Yutaka OIWA <[email-masked]>
Date: Sat, 7 Feb 2015 06:27:12 +0900

I'm fine, too.

-- 
Yutaka OIWA <[email-masked]> on mobile
2015/02/07 0:47 "Alexey Melnikov" <[email-masked]>:

>>> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-
>>> auth-info-latest-from-previous.diff.html>
>>>
>>>