Subject: PaceSecurityServices--do we need WSSE?

From: Ezra Cooper <[email-masked]>
Date: Thu, 8 Jul 2004 18:17:51 -0700

OK, since we're proceeding on PaceSecurityServices, I think we should 
move to tighten up the language a bit.

Here's a drawback to WSSE that I haven't seen discussed yet: If a legit 
client has its time set in the future, then its requests could be 
denied by the server, and yet an eavesdropper could store those tokens 
until such time as they fall within the window. For example, suppose 
Bob tries to make an Atom post at 12:00 UTC, but his computer's time 
reads 1:00 UTC (this is a common scenario where the time appears 
correct but is in the wrong timezone). The wsse digest is rejected 
because its timestamp is in the future. Bob wonders why his client is 
giving him errors. But Alice, who was listening in on Bob's TCP traffic 
at the corner cafe, has stored this PasswordDigest, with its timestamp 
of 1:00. Alice simply waits until 1:00 and then uses that token as a 
header on some mischievous update to Bob's blog. If Bob keeps retrying, 
getting frustrated, then Alice might collect any number of these 
freebies.

Digest doesn't have this problem because it doesn't rely on Bob having 
the correct timezone set.

I prefer Digest because a) it lets the server expire the tokens at its 
will, b) it already has spec text to allow for storing the password in 
a hashed form, and c) clock synchronization is not an issue. What's 
more, it has a mechanism for hashing the body (the auth-int qop), to 
protect against modification. It seems that all of the issues with 
Digest Auth that are listed in Mark's xml.com article [1] have been 
dealt with.

I haven't heard any support on-list for WSSE-style auth in some time. 
Is there still support for it? If not, can we drop it from the spec? If 
there is support I'm not opposed to allowing it, but in that case we 
need to fill in it's definition. I don't mean to squelch it if there's 
a need.

Thoughts on this?

Ezra

[1] http://www.xml.com/pub/a/2003/12/17/dive.html

---

From: Mark Pilgrim <[email-masked]>
Date: Thu, 8 Jul 2004 23:01:30 -0400

> I haven't heard any support on-list for WSSE-style auth in some time.

Contrary to popular belief, I have always been opposed to WSSE.  Joe
and I were early proponents of an algorithm that was as close to
Digest as possible, while still working in early adopter environments
such as Movable Type. [1]

My XML.com article was a description of the algorithm that I
understood Blogger and Typepad would be deploying, based on Ben's
implementation in his XML:Atom Perl module.  The article was never
meant to be a statement of support.  Apparently my naturally bubbly
personality shined through and confused people.  I'll try to ensure
that doesn't happen in the future.

[1] http://bitworking.org/news/New_AtomAPI_Implementation_Release2

-- 
Cheers,
-Mark