Subject: [Ietf-http-auth] [security-services] fyi: Technical Comparison: OpenID and SAML (Draft 05)
From: =JeffH <[email-masked]>
To: IETF Security Area Advisory Group <[email-masked]>, IETF HTTP Auth <[email-masked]>
Date: Tue, 18 Dec 2007 12:14:15 -0800
List-Id: ietf-http-auth.osafoundation.org

Of possible interest...

blogpost: (Draft) Technical Comparison: OpenID and SAML
<http://identitymeme.org/archives/2007/12/17/draft-technical-comparison-openid-and-saml/>

document: Technical Comparison: OpenID and SAML - Draft 05
http://identitymeme.org/doc/draft-hodges-saml-openid-compare-05.html

Abstract

This document presents a technical comparison of the OpenID Authentication
protocol and the Security Assertion Markup Language (SAML) Web Browser SSO
Profile and the SAML framework itself. Topics addressed include design centers,
terminology, specification set contents and scope, user identifier treatment,
web single sign-on profiles, trust, security, identity provider discovery
mechanisms, key agreement approaches, as well as message formats and protocol
bindings. An executive summary targeting various audiences, and presented from
the perspectives of end-users, implementors, tna deployers, is provided. We do
not attempt to assign relative value between OpenID and SAML, e.g. which is
"better"; rather, it attempts to present an objective technical comparison.

=JeffH

Date: Thu, 6 Dec 2007 02:33:01 -0600
From: Nicolas Williams <[email-masked]>
To: "Roy T. Fielding" <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked], Sam Hartman <[email-masked]>

On Wed, Dec 05, 2007 at 04:07:33PM -0800, Roy T. Fielding wrote:
> It would be a lot more useful to have a paper or small set
> of references that explains why all these assertions are
> believed to be true.  If you have such a thing, please post it.

Let me give some context that might help:

 - First, my presentation was very strongly influenced by
   draft-hartman-webauth-phishing-06.txt.

 - Second, my primary message to the Liberty folks was this: SAML,
   CardSpace, OpenID, etcetera, all such web authentication frameworks
   will fail to prevent phishing if the don't ensure that the server
   that the browser is connected to is not an MITM, because if phishers
   cannot steal authentication credentials but can still get in the
   middle, then they can still steal from users (e.g., by
   surreptitiously making bank transfers).  Phishers will mount MITM
   attacks if that's all they can do.

 - Third, my secondary message, was about UIs and federations.

   This I did not deliver quite so succinctly, but that's fine given that
   the target audience focus on the protocol aspects of web
   authentication.  I also had very limited time to present.

   This secondary message is based on an insight I got from Sam: that in
   the face of confusables and so on, the only thing that untrained
   users can rely on is their expectations of what they should find at
   some website.

   E.g., at your bank's site you expect a login page, and once logged in
   you expect to see specific account balances.

   Now, such expectations alone cannot defeat phishers who are mounting
   an MITM attack, and anyways, once the user gives their credentials to
   the phisher the game is lost anyways.  The next step is to reinforce
   the process by adding authentication and MITM detection to try to
   address that problem, but we still need to provide something that can
   meet expectations and in a way that the phisher gets nothing useful.

   The next insight is that if we have lots of smallish federations
   around, then the thing that the user can expect at any one site, such
   as their bank, is that the browser will have authenticated them as a
   specific identity.

   Users already expect to see the authenticated name of the server in
   their browser status bar + lock icon, but this alone is not enough as
   there may be confusables and CAs/registrars cannot help as much as
   we'd like.

   But small federations, by virtue of being small, can much more easily
   prevent sites with confusable names from participating than
   CAs/registrars can.

   The UI element I have in mind is a status-bar-like element that shows
   the federation used to do authentication (and possibly also the
   user's identity in that federation).

 - To summarize: federation + a UI element showing the user's identity
   as authenticated to the server + mutual user<->server authentication
   + MITM prevention/detection = a decent solution to phishing.

   The (federation + UI element showing... + mutual auth) part deals
   with non-MITM phishers.  The MITM prevention/detection part rounds
   out the picture.

 - There are several ways to detect/prevent MITMs in these apps (which,
   today, pretty much all use TLS).

   Three of these are:

    - push authentication down into TLS
    - get rid of TLS and push cryptographic session protection up to the
      application layer
    - use channel binding of authentication at the application layer to
      the TLS channels making up the session

   Of these I believe the channel binding solution is the best.  But
   given the efforts to add GSS-API support to TLS I think we cannot
   discount the first item either.  Finally, in the OASIS WSS TC / SOAP
   world I wouldn't discount the push-session-crypto-up approach.

 - Note that the federation enrolment case can still be susceptible to
   phishing.  I.e., this scheme, if it works, pushes the opportunity for
   phishing to an area that's much less frequent that normal user web
   browsing activity.

Nico
-- 

Date: Wed, 5 Dec 2007 18:15:42 -0600
From: Nicolas Williams <[email-masked]>
To: "Roy T. Fielding" <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked], Sam Hartman <[email-masked]>

On Wed, Dec 05, 2007 at 04:07:33PM -0800, Roy T. Fielding wrote:
> It would be a lot more useful to have a paper or small set
> of references that explains why all these assertions are
> believed to be true.  If you have such a thing, please post it.

It would also be useful to have the time to write such a thing.  Perhaps
Sam can step in for me and explain at length.

I don't know if there's a recording of my presentation.  I'll inquire.

From: "Roy T. Fielding" <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Date: Wed, 5 Dec 2007 16:07:33 -0800
To: Nicolas Williams <[email-masked]>
Cc: [email-masked], Sam Hartman <[email-masked]>

It would be a lot more useful to have a paper or small set
of references that explains why all these assertions are
believed to be true.  If you have such a thing, please post it.

....Roy

Date: Wed, 5 Dec 2007 17:54:21 -0600
From: Nicolas Williams <[email-masked]>
To: Sam Hartman <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked]

[re-send]
On Wed, Nov 28, 2007 at 07:22:41PM -0500, Sam Hartman wrote:
> >>>>> "Eliot" == Eliot Lear <[email-masked]> writes:
> 
>     Eliot> Roy T. Fielding wrote:
>     >> Perhaps.  I don't believe that CAs are careful enough in
>     >> issuing certificates, and it is certainly the case that not all
>     >> TLS sites bother to pay the tax for CA-signed certs.  This
>     >> algorithm should not be dependent on them.  Perhaps what I am
>     >> looking for is a mechanism that doesn't require Mutual Auth
>     >> (aside from proving knowledge of a shared secret), but can
>     >> still detect MITM.
> 
>     Eliot> Fundamentally phishing is possible because of an absence of
>     Eliot> mutual authentication.  I guess I don't understand what
>     Eliot> problem you are attempting to solve.
> 
> He's attempting to take advantage of membership in a federation to
> avoid dependence on CAs.  I.E. section 4.6 of my draft.
> 
> My text in this regard needs to be improved significantly.  Nico
> Williams managed to state it much more clearly in a presentation he
> gave to Liberty and I need to incorporate his restatements.

My presentation to the Liberty Staff is here:

http://mediacast.sun.com/share/nico/liberty-staff-tls-channel-binding-short.pdf

See also my blog:

http://blogs.sun.com/nico

The short version is this:

 - we need to mutually authenticate users and servers

 - there must be a link between the authentication of users to servers
   and servers to users

 - this link must be such that users can determine whether to trust the
   server according to what "federation" was used to authenticate the
   user to the server

 - "federation" matters because federations are (must) be smaller than
   the capital-I Internet and, therefore, are able to effectively
   white-/black-list member sites.

   I.e., a "Bank of Foo" federation should only allow my identity in
   that federation to be used to authenticate to sites that the "Bank of
   Foo" federation administrators trust.  The "Bank of Foo" federation
   can check for confusables, etc... in applicant members because they
   have few members compared to the number of domains that exist in each
   TLD (say).

   A "Bloggers Union of Foobar" federation might have many, many more
   members, and thus be less able to keep out phishers, but users would
   know not to trust, with important non-blogging data, sites to which
   they authenticate with "Bloggers Union of Foobar" identities.

 - That last point brings up something important: UIs matter.  The UI
   in this proposal *must* make it clear to the user not just the name
   of the site (think: status bar) but the identity/federation used to
   authenticate the user.

 - The binding/mutuality of user<->server authentication is necessary to
   prevent MITM attacks.

Nico
-- 

Date: Wed, 5 Dec 2007 17:05:58 -0600
From: Nicolas Williams <[email-masked]>
To: Sam Hartman <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked]

On Wed, Nov 28, 2007 at 06:37:38PM -0600, Nicolas Williams wrote:
> [re-send without my slides attached, so it makes it to the list faster.]

http://mediacast.sun.com/share/nico/liberty-staff-tls-channel-binding-short.pdf

To: HTTP authentication list <[email-masked]>
From: Lisa Dusseault <[email-masked]>
Date: Wed, 5 Dec 2007 10:14:44 -0800
Subject: [Ietf-http-auth] Narrative notes from bar BoF

--Apple-Mail-9--472047647
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

6:00pm to 7:30 pm, Vancouver 70th IETF, narrative notes

Eliot Lear: volunteer to put some goals, if we can agree on them,  
into a draft charter.
Phil Hallam-Baker: ... We need to have identifiers that consistently  
identify us across the Web.
Lisa Dusseault: Does everybody agree we need leveraged identities?
Jeff Hodges: That's called single sign-on
Eliot Lear: authentication has a role to play in devaluing the assets  
of botnet controllers.
Sam Hartman: I can host a workshop on this
Yutaka Oiwa: For a web system, the ultimate goal is authentication of  
Web system, not only HTTP request, but actually the response:  
authenticate the *response* and the user reacts to that.
Sam: I like Nico's extensions for integrating this as they're  
modular.  Not mechanism-specific.
Lisa: Any disagreement with the goal that we're not inventing new  
authentication mechanism?
Phil: Go further, it's not a goal to invent a new authentication  
*framework* since we already have some.
Leif Johansson: you have to be careful about layering ...
Joseph Salowey: there are a lot of ways you can layer these things,  
this doesn't mean you'll do all these things together
Kurt Zeilenga: We want to reuse mechanisms from existing frameworks.
	[agreement]
Sam: If we can change my phishing draft to express goals for this  
effort, let's change it (as long as they're phishing related goals)
Leif: Enterprise goal of reusing frameworks, is a goal but not a  
phishing goal.
Chris Newman: There may be some priorities.  I think the anti- 
phishing goal is more important than some others.
	[agreement]
Lisa: I've heard other groups with the goal of making new  
authentication that works without upgrading browsers with new code.
Sam: I don't think that's consistent with security.
Lisa: Right. I don't think you can have all of: browser backward- 
compatibility, leveraged identities and phishing protection.
Jeff: Anyway, other organizations have covered this space. SAML, OpenID.
Chris: It is likely the outcome of this effort will require browser  
changes.
	[Agreement]
Sam: It is a goal that this supports things other than browsers.   
CalDAV, WebDAV.
	[agreement.]
Sam: Let's not break any mechanism that support that case, but not go  
out of our way to solve it:
Eliot: Very small federation inside the house may be in scope.
Sam: Specific example.  To scale down kerberos or digest, you would  
need an initial way to get your account setup. That's mechanism  
specific, but to scale down to small number of users, you'dneed a way  
to do that.  Requirements for that use case may be in scope, but  
changes to existing mechanisms like Digest or Kerberos should not be  
inscope for this forum.
Eliot: The neighbour managing the routing case, which is "have I seen  
you before"
Leif: This is lightweight federation
Stephen Farrell: What about scaling up, people who have not met each  
other being able to interact?
Sam: The mechanism work shouldn't be in scope, but the requirements  
are in scope.
Joseph Salowey: That means that we have to pick only existing  
mechanisms that solve these requirements?
Leif: Can you push the work onto another group like Kerberos?
Sam: Your mechanism needs to have an enrollment strategy that does  
specific things.  We're trying to do the glue and not
Lisa: Are we choosing what to glue?
Sam: We may choose mandatory to implement, but not limit the selection.
	[agreement]
Phil: I've been at a panel where people thought authentication meant  
two entirely different things. Are we doing contact authentication  
(like SSL certificates, password enrolment) or initial first-round  
authentication when you make contact with a Web server and use a one- 
time password, PKI token and a secondary mechanism to back it up?   
Cookies, lightweight recycling.  Three things to keep separate:  
enrolment (first contact), authentication and state management.
Sam: Our primary focus should be authentication, with possibly work  
on state management.
Leif: We might focus on state management for the purpose of  
authentication.   Not solve the general state management. An in-band  
mechanism for HTTP might not rely on cookies.
Phil: Cardspace is what cookies should have been: under user control  
and associated with information where the user can choose to release.
	[no disagreement on the scope possibly covering state maintenance or  
auth maintenance.]
Eliot: do we focus on form authentication in this forum?
Sam: Maybe.
Chris: I view it as authentication dialog branding as part of the  
mechanism.  There's a reason people choose forms.
Joseph: People want to do rich content...
Lisa: Saying "authentication dialog branding" is already selecting a  
user interface, I'm not sure we can do that.  We're not sure that  
branding is the only reason people eschew dialogs, there may also be  
need for navigation links, links and text for things you can do if  
you don't log in.
Sam: Nico's draft is good for this because it allows existing  
interfaces to be done securely.
Eliot.  A workshop that includes W3C and oasis could solve this problem.
Phil: Yes, the effort is diffuse and lacks critical mass.
Leif: So we carefully scope this.  In-band authentication seems to be  
the commonality.
Eliot: Not just the right standards bodies involved, but the right  
people involved: Google, MS, Mozilla, Apple are in the room.
Mark Nottingham: You need users involved: sites like EBay, Amazon,  
people who have concerns that nobody in this room is talking about.
Sam: That's too many people for a workshop.
Mark: Building something that works in the security world, but  
doesn't map to the requirements of users, happens all the time.
Tom Yu: Workshop should invite people who can agregate common  
concerns and present that.
Phil: Suggest David Solo from CitiGroup;
Peter St Andre: Be exclusive for this workshop.  Only people who are  
crucial.
Phil: W3C workshop: require people to write position papers, weeds  
out the tourists.
Sam: I volunteer Eliot and myself and one or two others to organize a  
workshop.    We could also just do a WG and simultaneously get the  
effort to get participation from other people.
Keith Moore: You need a workshop to decide what to do next even if  
it's a WG.
Mark: Will a workshop be substantially different than the BoF in  
Montreal?
Sam: If we're limiting it to IETF scope, then it would not be  
different and would be worthless.  So let's not limit it.
Eliot: we need to get the right people and that they understand the  
scope is not just IETF.
Phil: Doing this under "Note Well" rules is important.

Lisa: Did we have agreement on authenticating the response?
[somebody said this is the same as mutual auth]
Sam: No, that is differen than mutual auth.  You want to know that  
the page you get back was really from the party you mutually  
authenticated to.
Eliot: Authentication across transactions, if you will. This was in  
your phishing draft.
Lisa: Any disagreemtent on addressing that?  [none at first, but  
then...]
Joseph: Authenticating the data can be difficult, because it might  
not come from the source that you authenticatied.
Sam: Packaging it up is ok.  You need to know that the source you  
vetted provided it.
Jeff: Even images, links in pages?

Eliot read a bunch of charter notes and confirmed.

Cyrus Daboo: What's the expected outcome of the workshop?
Sam: Set of tasks to accomplish, where the tasks include writing  
code, IETF standards, and other organizations standards.

Eliot: And web forms?
Sam: In one model, you have glop in forms that triggers in-band  
notification.
Eliot: How can we express that without closing down too tightly?  The  
high level goal?
Sam: Yes, include the goal to support Web forms, and I'll argue that  
the solution is the same.
Mark. And Web services are covered.

Mark. What about OAuth?
Sam: My conclusion is that it didn't solve anti-phishing well.
Leif: It solves the N-tier problem:
Lisa: Explain?
Cyrus: WebMail. I need to proxy my credentials from my browser  
through the Web interface to my email server.
Mark: Or you want a mashup to be able to access your photos on Flickr  
for their cool thing; you give them rights.
Jeff: That's only one tier, you're delegating rights, not doing  
authentication.
Sam: it could be a limited use credential.

Tom: Are we agreed our task is larger than protocol? We work on  
conceptual things, cognitive landscape?
Mark: Who "we" are is interesting there.
Sam: The people sitting around this room need to be involved in more  
than just the IETF for this to work.

Lisa: who will be proposing a BOF?
Eliot: Perhaps an outcome of the workshop is charters for work in  
various SDOs.  Cisco sometimes asks academics to do vague things; we  
can do the analogous thing in asking help for a charter or WG.
Sam: I'm not convinced a workshop is strictly necessary.
Leif: The workshop could follow on a WG too, to establish consensus  
with other SDOs.

Lisa: I personally was hoping we would do some small yet important  
fixes, even if we didn't solve the big problems with other SDOs.
Derek Atkins: To do the small fixes, do we have the IE and firefox  
people here?

***Leif: Can we get everybody on the list?

Eliot: What would solve your problem Robert Sayre?
Robert Sayre: I've been trying to find a solution to shared secret  
authentication, that we can actually use, and do branding.
Sam: I think you could turn HTTP-Nego into something you could use  
for that.
Eliot: What is gating you from addressing the problem you just  
described?
Robert: Every time we get into mutual authentication and message  
integrity, TLS becomes a requirement.  I'm dubious of that.  People  
don't use that.
Sam: You believe a mechanism should provide message integrity even  
without TLS?
Robert: The identity should be encrypted, even if the message is not  
encrypted.
Phil: We seem to think the auth here should be username/password.
Robert.  That's one problem I'm trying to solve.

Sam: We're hearing don't gate on a workshop.  I'd like to get Robert  
and somebody from the right part of Apple, the safari group.
Cyrus: I'm not from the right part, the CalSched group is trying to  
do cross-domain scheduling.  We don't want to have the spam problem  
we have in email, so we need federated authetnication and access  
control to do this.  We're not trying to define protocols, but rather  
requirements for the IETF work.

Eliot: How do we bring implementors in?
Cyrus: Interops.  People demonstrate phishing, see problem in real  
products.
Eliot: Demonstrating problems, not solutions?  Everybody accepts  
there is a problem.
Tom: The problem with demonstrating phishing is that will focus  
people on the details of phishing, not on the conceptual model.
Leif: How do you get implementors involved? You have a BOF and you  
ask if anybody in the room is going to implement the work.
Eliot: That's what WAE did and it failed.
Lisa: It didn't fail, it just failed to follow through.
Sam: It didn't even fail to follow through, Leif has been working on  
his draft, several of us have been working on pieces and will be  
ready with a specific proposal for a BoF.
Eliot: This argues not even a workshop, but a cabal building a  
constituency.
Mark: Devils advocate, not just getting vendors involved in the  
beginning.  If we get a new protocol introduced on a number of large  
Web sites, and in Mozilla, that is a path forward.   You need a  
browser and a site.
Eliot: You want to have a couple more people than you would otherwise  
try, because RSI or IIW have a ton of solutions and we have so many  
pet solutions.  They want to drive it through.
Mark: I've heard probelms on the table, the hard part is figuring out  
what's going forward.
Eliot; People trying to solve this problem can't have vendors own  
solutions.  The biggest vendor tried to play that.  We have sloughs  
of vendors playing kings of mountains, and diffusion.

Leif: We shouldn't hang up non-browser applications on the phishing  
problem.  We may find phishing to be a social problem.
Keith: you can't separate the probelms.
Leif: The non-browser, HTTP problem is unique to us and we need to  
solve it.

Sam: Please review my draft, section 1.1. Are we headed in the right  
section.

Chris: How do we get convergence? The thing that no other  
organization is doing is trying to solve the non-browser problem.
Sam: I dont' know if anybody else is looking at mutual authentication.
Chris: True, but I don't know if mutual auth is a req't of people  
we'd need to converge.
Sam: We can use people like the banks to convince them they need it.
Mark: Non-browser auth is in my area, with interesting and hard  
req'ts.  I want to allow 3rd party code to auth against my service,  
but not to get the user access to those credentials
Chris: That's too hard.

Lisa; The list is [email-masked].  Everybody  
joining or on that list, right?
Lisa: Any objections if I post these notes to the list?  [none]

Eliot: What are we doing next?  I haven't heard a consensus view how  
to proceed.
Leif: We could do a BOF around the non-browser auth.
Keith: That's a piece the IETF could work on, yes, and get moving,  
but the workshop is important too.

Eliot: Sam, Mark and I will propose how to proceed to this list.   
We're going to do that through email next week.

Eliot: So everybody's going to look at Sam and Leif's documents.

--Apple-Mail-9--472047647
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=ISO-8859-1

<HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; =
-khtml-line-break: after-white-space; "><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">6:00pm to =
7:30 pm, Vancouver 70th IETF, narrative notes</DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot Lear: =
volunteer to put some goals, if we can agree on them, into a draft =
charter.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil Hallam-Baker: =
... We need to have identifiers that consistently identify us across the =
Web.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa Dusseault: =
Does everybody agree we need leveraged =
identities?=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Jeff Hodges: =
That's called single sign-on</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot Lear: =
authentication has a role to play in devaluing the assets of botnet =
controllers. =A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam Hartman: I can =
host a workshop on this</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Yutaka Oiwa: For a =
web system, the ultimate goal is authentication of Web system, not only =
HTTP request, but actually the response: authenticate the *response* and =
the user reacts to that. =A0</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: I like Nico's =
extensions for integrating this as they're modular.=A0 Not =
mechanism-specific.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Any =
disagreement with the goal that we're not inventing new authentication =
mechanism?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: Go further, =
it's not a goal to invent a new authentication *framework* since we =
already have some.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif Johansson: =
you have to be careful about layering ...=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Joseph Salowey: there are a lot of ways you can layer these =
things, this doesn't mean you'll do all these things =
together</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Kurt Zeilenga: We =
want to reuse mechanisms from existing =
frameworks.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: =
11px;">[agreement]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: If we can =
change my phishing draft to express goals for this effort, let's change =
it (as long as they're phishing related goals)</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Leif: Enterprise goal of reusing frameworks, is a goal but not a =
phishing goal.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris Newman: =
There may be some priorities.=A0 I think the anti-phishing goal is more =
important than some others.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: =
11px;">[agreement]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: I've heard =
other groups with the goal of making new authentication that works =
without upgrading browsers with new code.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: I don't think that's consistent with =
security.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Right. I =
don't think you can have all of: browser backward-compatibility, =
leveraged identities and phishing protection.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Jeff: Anyway, other organizations have covered this space. SAML, =
OpenID.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris: It is =
likely the outcome of this effort will require browser =
changes.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: =
11px;">[Agreement]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: It is a goal =
that this supports things other than browsers.=A0 CalDAV, =
WebDAV.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: =
11px;">[agreement.]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: Let's not =
break any mechanism that support that case, but not go out of our way to =
solve it:=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: Very small =
federation inside the house may be in scope.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: Specific example.=A0 To scale down kerberos or digest, you =
would need an initial way to get your account setup. That's mechanism =
specific, but to scale down to small number of users, you'dneed a way to =
do that.=A0 Requirements for that use case may be in scope, but changes =
to existing mechanisms like Digest or Kerberos should not be inscope for =
this forum.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: The =
neighbour managing the routing case, which is "have I seen you =
before"</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: This is =
lightweight federation</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Stephen Farrell: =
What about scaling up, people who have not met each other being able to =
interact?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: The mechanism =
work shouldn't be in scope, but the requirements are in scope. =
=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Joseph Salowey: That means that we have to =
pick only existing mechanisms that solve these =
requirements?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: Can you push =
the work onto another group like Kerberos?</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: Your mechanism needs to have an enrollment strategy that =
does specific things.=A0 We're trying to do the glue and =
not=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Are we =
choosing what to glue?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: We may choose =
mandatory to implement, but not limit the =
selection.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: =
11px;">[agreement]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: I've been at =
a panel where people thought authentication meant two entirely different =
things. Are we doing contact authentication (like SSL certificates, =
password enrolment) or initial first-round authentication when you make =
contact with a Web server and use a one-time password, PKI token and a =
secondary mechanism to back it up?=A0 Cookies, lightweight recycling.=A0 =
Three things to keep separate: enrolment (first contact), authentication =
and state management.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: Our primary =
focus should be authentication, with possibly work on state =
management.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: We might =
focus on state management for the purpose of authentication. =A0 Not =
solve the general state management. An in-band mechanism for HTTP might =
not rely on cookies.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: Cardspace is =
what cookies should have been: under user control and associated with =
information where the user can choose to =
release.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><SPAN =
class=3D"Apple-tab-span" style=3D"white-space:pre">	</SPAN><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">[no disagreement =
on the scope possibly covering state maintenance or auth =
maintenance.]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: do we focus =
on form authentication in this forum?=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: Maybe.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris: I view it =
as authentication dialog branding as part of the mechanism.=A0 There's a =
reason people choose forms. =A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Joseph: People want to do rich =
content...=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Saying =
"authentication dialog branding" is already selecting a user interface, =
I'm not sure we can do that.=A0 We're not sure that branding is the only =
reason people eschew dialogs, there may also be need for navigation =
links, links and text for things you can do if you don't log =
in.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Sam: Nico's draft is good for this because it =
allows existing interfaces to be done securely.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Eliot.=A0 A workshop that includes W3C and oasis could solve this =
problem.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: Yes, the =
effort is diffuse and lacks critical mass.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Leif: So we carefully scope this.=A0 In-band authentication seems =
to be the commonality.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: Not just =
the right standards bodies involved, but the right people involved: =
Google, MS, Mozilla, Apple are in the room.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Mark Nottingham: You need users involved: sites like EBay, =
Amazon, people who have concerns that nobody in this room is talking =
about.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: That's too =
many people for a workshop.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark: Building =
something that works in the security world, but doesn't map to the =
requirements of users, happens all the time.=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Tom Yu: Workshop should invite people who can agregate common =
concerns and present that.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: Suggest =
David Solo from CitiGroup;=A0</SPAN></FONT></DIV><DIV style=3D"margin-top:=
 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Peter St Andre: Be =
exclusive for this workshop.=A0 Only people who are =
crucial.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: W3C =
workshop: require people to write position papers, weeds out the =
tourists.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: I volunteer =
Eliot and myself and one or two others to organize a workshop.=A0 =A0 We =
could also just do a WG and simultaneously get the effort to get =
participation from other people.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Keith Moore: You need a workshop to decide what to do next even =
if it's a WG.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark: Will a =
workshop be substantially different than the BoF in =
Montreal?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: If we're =
limiting it to IETF scope, then it would not be different and would be =
worthless.=A0 So let's not limit it.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Eliot: we need to get the right people and that they understand =
the scope is not just IETF.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: Doing this =
under "Note Well" rules is important.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Lisa: Did we have agreement on authenticating the =
response?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">[somebody said =
this is the same as mutual auth]</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: No, that is differen than mutual auth.=A0 You want to know =
that the page you get back was really from the party you mutually =
authenticated to. =A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: =
Authentication across transactions, if you will. This was in your =
phishing draft.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Any =
disagreemtent on addressing that?=A0 [none at first, but =
then...]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Joseph: =
Authenticating the data can be difficult, because it might not come from =
the source that you authenticatied.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: Packaging it up is ok.=A0 You need to know that the source =
you vetted provided it.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Jeff: Even images, =
links in pages?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Eliot read a bunch of charter notes and =
confirmed.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Cyrus Daboo: What's the expected outcome of =
the workshop?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: Set of tasks =
to accomplish, where the tasks include writing code, IETF standards, and =
other organizations standards.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: And web =
forms?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: In one model, =
you have glop in forms that triggers in-band =
notification.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: How can we =
express that without closing down too tightly?=A0 The high level =
goal?=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: Yes, include =
the goal to support Web forms, and I'll argue that the solution is the =
same.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark. And Web =
services are covered.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Mark. What about =
OAuth?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: My conclusion =
is that it didn't solve anti-phishing well.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Leif: It solves the N-tier problem: =A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Lisa: Explain?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Cyrus: WebMail. I =
need to proxy my credentials from my browser through the Web interface =
to my email server.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark: Or you want =
a mashup to be able to access your photos on Flickr for their cool =
thing; you give them rights.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Jeff: That's only =
one tier, you're delegating rights, not doing =
authentication.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: it could be a =
limited use credential.</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: =
normal normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Tom: Are we agreed our task is larger than protocol? We work on =
conceptual things, cognitive landscape?</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Mark: Who "we" are is interesting there.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: The people sitting around this room need to be involved in =
more than just the IETF for this to work.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: who will be =
proposing a BOF?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: Perhaps an =
outcome of the workshop is charters for work in various SDOs.=A0 Cisco =
sometimes asks academics to do vague things; we can do the analogous =
thing in asking help for a charter or WG.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: I'm not convinced a workshop is strictly =
necessary.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: The workshop =
could follow on a WG too, to establish consensus with other =
SDOs.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Lisa: I personally was hoping we would do some small yet =
important fixes, even if we didn't solve the big problems with other =
SDOs.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Derek Atkins: To =
do the small fixes, do we have the IE and firefox people =
here?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">***Leif: Can we =
get everybody on the list?</SPAN></FONT></DIV><DIV style=3D"margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: =
normal normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Eliot: What would solve your problem Robert =
Sayre?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Robert Sayre: I've =
been trying to find a solution to shared secret authentication, that we =
can actually use, and do branding.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: I think you could turn HTTP-Nego into something you could =
use for that.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: What is =
gating you from addressing the problem you just =
described?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Robert: Every time =
we get into mutual authentication and message integrity, TLS becomes a =
requirement.=A0 I'm dubious of that.=A0 People don't use =
that.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: You believe a =
mechanism should provide message integrity even without =
TLS?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Robert: The =
identity should be encrypted, even if the message is not =
encrypted.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Phil: We seem to =
think the auth here should be username/password.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Robert.=A0 That's one problem I'm trying to =
solve.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: We're hearing don't gate on a workshop.=A0 I'd like to get =
Robert and somebody from the right part of Apple, the safari =
group.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Cyrus: I'm not =
from the right part, the CalSched group is trying to do cross-domain =
scheduling.=A0 We don't want to have the spam problem we have in email, =
so we need federated authetnication and access control to do this.=A0 =
We're not trying to define protocols, but rather requirements for the =
IETF work.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Eliot: How do we bring implementors =
in?</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Cyrus: Interops.=A0 People demonstrate =
phishing, see problem in real products.=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Eliot: Demonstrating problems, not solutions?=A0 Everybody =
accepts there is a problem.=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Tom: The problem with demonstrating phishing is that will focus =
people on the details of phishing, not on the conceptual =
model.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: How do you =
get implementors involved? You have a BOF and you ask if anybody in the =
room is going to implement the work.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Eliot: That's what WAE did and it failed.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Lisa: It didn't fail, it just failed to follow =
through.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: It didn't =
even fail to follow through, Leif has been working on his draft, several =
of us have been working on pieces and will be ready with a specific =
proposal for a BoF.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: This argues =
not even a workshop, but a cabal building a =
constituency.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark: Devils =
advocate, not just getting vendors involved in the beginning.=A0 If we =
get a new protocol introduced on a number of large Web sites, and in =
Mozilla, that is a path forward. =A0 You need a browser and a site. =
=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Eliot: You want to have a couple more people =
than you would otherwise try, because RSI or IIW have a ton of solutions =
and we have so many pet solutions.=A0 They want to drive it =
through.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Mark: I've heard =
probelms on the table, the hard part is figuring out what's going =
forward. =A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot; People =
trying to solve this problem can't have vendors own solutions.=A0 The =
biggest vendor tried to play that.=A0 We have sloughs of vendors playing =
kings of mountains, and diffusion. =A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: We shouldn't =
hang up non-browser applications on the phishing problem.=A0 We may find =
phishing to be a social problem.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Keith: you can't separate the probelms.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Leif: The non-browser, HTTP problem is unique to us and we need =
to solve it.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 11px/normal Lucida Grande; min-height: 13px; =
"><BR></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Sam: Please review my draft, section 1.1. Are =
we headed in the right section.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris: How do we =
get convergence? The thing that no other organization is doing is trying =
to solve the non-browser problem.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Sam: I dont' know if anybody else is looking at mutual =
authentication.=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris: True, but I =
don't know if mutual auth is a req't of people we'd need to =
converge.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Sam: We can use =
people like the banks to convince them they need =
it.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><FONT class=3D"Apple-style-span" =
face=3D"Lucida Grande" size=3D"3"><SPAN class=3D"Apple-style-span" =
style=3D"font-size: 11px;">Mark: Non-browser auth is in my area, with =
interesting and hard req'ts.=A0 I want to allow 3rd party code to auth =
against my service, but not to get the user access to those =
credentials=A0</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Chris: That's too =
hard.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Lisa; The list is </SPAN></FONT><A =
href=3D"mailto:[email-masked]."><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;"><FONT =
class=3D"Apple-style-span" =
color=3D"#0020E2">[email-masked].</FONT></SPAN></FONT></=
A><A href=3D"mailto:[email-masked]"><FONT =
class=3D"Apple-style-span" color=3D"#0020E2">=A0 </FONT></A>Everybody =
joining or on that list, right?</DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Lisa: Any =
objections if I post these notes to the list?=A0 =
[none]</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; margin-right: =
0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
11px/normal Lucida Grande; min-height: 13px; "><BR></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Eliot: What are we doing next?=A0 I haven't heard a consensus =
view how to proceed.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Leif: We could do =
a BOF around the non-browser auth.=A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><FONT class=3D"Apple-style-span" face=3D"Lucida =
Grande" size=3D"3"><SPAN class=3D"Apple-style-span" style=3D"font-size: =
11px;">Keith: That's a piece the IETF could work on, yes, and get =
moving, but the workshop is important too.</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: Sam, Mark =
and I will propose how to proceed to this list.=A0 We're going to do =
that through email next week. =A0</SPAN></FONT></DIV><DIV =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 11px/normal Lucida Grande; =
min-height: 13px; "><BR></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT =
class=3D"Apple-style-span" face=3D"Lucida Grande" size=3D"3"><SPAN =
class=3D"Apple-style-span" style=3D"font-size: 11px;">Eliot: So =
everybody's going to look at Sam and Leif's =
documents.</SPAN></FONT></DIV><DIV style=3D"margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><BR =
class=3D"khtml-block-placeholder"></DIV></BODY></HTML>=

--Apple-Mail-9--472047647--

From: Mark Nottingham <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Date: Tue, 4 Dec 2007 12:49:59 -0800
To: Sam Hartman <[email-masked]>
Cc: [email-masked]

OK, so let's do it 6pm, meet at the message board, finish before 8.

On 2007/12/03, at 8:13 AM, Sam Hartman wrote:

> On Tuesday, I could attend 6-8 but I would have to leave at 8 for an
> ifare dinner.
> I could not attend today at all.
>
>

--
Mark Nottingham       [email-masked]

From: Sam Hartman <[email-masked]>
To: Eliot Lear <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Date: Mon, 03 Dec 2007 11:13:24 -0500
Cc: [email-masked]

On Tuesday, I could attend 6-8 but I would have to leave at 8 for an
ifare dinner.
I could not attend today at all.

From: Mark Nottingham <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Date: Sun, 2 Dec 2007 13:40:07 -0800
To: Alexey Melnikov <[email-masked]>
Cc: [email-masked]

I have to drive to Bellevue that evening, so capping it at 8 works  
for me.

On 2007/12/02, at 1:28 PM, Alexey Melnikov wrote:

> Mark Nottingham wrote:
>
>> The other option would be Monday, but HTTPBIS runs pretty late,  
>> and  IIRC some people already have plans...
>
> Indeed.
>
> I am personally fine with meeting at 6pm on Tuesday, but I would  
> have to leave around 8pm.
>
>> On 2007/12/01, at 12:51 PM, Alexey Melnikov wrote:
>>
>>> Eliot Lear wrote:
>>>
>>>> Mark Nottingham wrote:
>>>>
>>>>> How about Tuesday 6pm (unless ltans a potential conflict)?
>>>>
>>>> Unfortunately everyone else wants to meet for a bar bof at that   
>>>> time :-(
>>>
>>> As long as this doesn't overrun the Vcarddav dinner happening  
>>> later  on Tuesday.
>>> I believe some people might be interested in attending both.
>>
>

--
Mark Nottingham       [email-masked]

Date: Sun, 02 Dec 2007 21:28:46 +0000
From: Alexey Melnikov <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Cc: [email-masked]

Mark Nottingham wrote:

> The other option would be Monday, but HTTPBIS runs pretty late, and  
> IIRC some people already have plans...

Indeed.

I am personally fine with meeting at 6pm on Tuesday, but I would have to 
leave around 8pm.

> On 2007/12/01, at 12:51 PM, Alexey Melnikov wrote:
>
>> Eliot Lear wrote:
>>
>>> Mark Nottingham wrote:
>>>
>>>> How about Tuesday 6pm (unless ltans a potential conflict)?
>>>
>>> Unfortunately everyone else wants to meet for a bar bof at that  
>>> time :-(
>>
>> As long as this doesn't overrun the Vcarddav dinner happening later  
>> on Tuesday.
>> I believe some people might be interested in attending both.
>

From: Mark Nottingham <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Date: Sun, 2 Dec 2007 13:20:18 -0800
To: Alexey Melnikov <[email-masked]>
Cc: [email-masked]

The other option would be Monday, but HTTPBIS runs pretty late, and  
IIRC some people already have plans...

On 2007/12/01, at 12:51 PM, Alexey Melnikov wrote:

> Eliot Lear wrote:
>
>> Mark Nottingham wrote:
>>
>>> How about Tuesday 6pm (unless ltans a potential conflict)?
>>>
>> Unfortunately everyone else wants to meet for a bar bof at that  
>> time :-(
>>
> As long as this doesn't overrun the Vcarddav dinner happening later  
> on Tuesday.
> I believe some people might be interested in attending both.
>

--
Mark Nottingham       [email-masked]

Date: Sun, 02 Dec 2007 09:42:53 -0800
From: Eric Rescorla <[email-masked]>
To: Yutaka OIWA <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked]

At Fri, 30 Nov 2007 04:41:41 +0900,
Yutaka OIWA wrote:
> 
> Dear Eric and other people discussing the issue recently,
> 
> Thank you very much for the comment.
> 
> Eric Rescorla <[email-masked]> writes:
> 
> > A few questions/comments:
> >
> > 1. I don't see why this makes sense to do at the HTTP layer. Wouldn't
> >    it be more straightforward to do this in TLS rather than adapting
> >    Digest? I also would note that TLS-SRP has already been approved
> >    by the IESG.
> 
> In short, We found that TLS-SRP is not well suited for web applications.
> 
> Web authentications are basically application-layer issues.  In real
> web sites like Google or Yahoo!, there are both unauthenticated
> contents and authenticated contents on one server, and also there are
> many independent "authentication realms" which request different sets
> of authentication credentials.  One of these realms (including
> "no-authentication" realm) are assigned for each requested Web
> resource, which is determined by the HTTP-layer request URI and other
> headers.  When TLS-SRP is used, however, the authentication starts
> before the client tells the server what resource are requested.  This
> gives great difficulty for designing web sites and inapplicability for
> many existing systems.

Well, this certainly is a difficulty, but there are a number of ways
around this, including: 

(1) Hosting apps with different security policies on different
    virtual servers and using the server_name extension to
    disambiguate.
(2) Renegotiate (I realize you don't like this, but see below
    for why I don't find your argument convincing).

So, I don't consider this to be a "great difficulty".

More importantly, using any HTTP level mechanism for mutual
makes it difficult for the *client* to get the right security
properties, because he blindly sends requests to the servers,
including ones that potentially contain sensitive information,
before the server has authenticated. By contrast any TLS-based
mechanism forces the server to authenticate first before any
sensitive data is exchanged. (And you can't say you're going
to use TLS underneath here because the whole premise is that
you don't trust the server's cert).

Incidentally, there was a similar problem in RFC 2817, which
is part of why it was never really adopted in Web systems.

> One might also think that combination of TLS-SRP and TLS renegotiation
> can be useful to solve the issue. But it is very unlikely to specify
> and implement correctly an appropriate mechanism for Web
> authentication using some kinds of tricky "authentication tunneling"
> behaviors. 

I have no idea what this means.

> The simple HTTP-layer authentication is much clearer and
> better.  Furthermore, introduced in HTTP/1.1, there is HTTP Keep-alive
> feature that allows more than one HTTP-layer requests on one TLS (or
> TCP) transport-layer connections.  This adds further complexity for
> such specifications.

On the contrary. Keep-alive is what makes this an attractive
technique.

> > 3. There are a large number of PAKE/ZKPP protocols. Can you please
> >    explain why one would want this protocol versus others?
> 
> There are some criteria which are required for use in our Mutual
> Authentication Protocol:
> 
>   (1) There are only four messages for one authentication
>       (including key sharing confirmation).

This applies to SRP.

>   (2) Among those, key sharing is done in first two messages,
>       and final two messages are only for lightweight key confirmation.
>       This is required because our scheme uses one shared key for
>       several requests by re-sending final two messages only.
>       This reduces overhead for repeatedly performing public-key
>       cryptographic operations.

You don't need to do things this way. Use the exchanged key to
MAC the rest of the HTTP traffic with some other system.

>   (3) Those final two messages must be able to be extended so that we
>       can put additional confirmation data such as nonces and
>       validation tokens (v) into that messages.  Note that this is
>       very important point: in our scheme, this modification to the
>       messages are important to prevent man-in-the-middle attacks.

See above.

> In addition to this, In KAM3 required secret is asymmetric: the server
> only needs "encrypted" (or "hashed") password, and does not need
> having the real password value (pi) itself.  These are the reasons we
> chose ISO-defined variant as a basis.

Again, applies to SRP. 

My understanding is that these are fairly standard
features of PAKE systems.

> Finally, we currently think that, as far as we know, other patents on
> related fields are not applicable for this technique either because it
> is out of the claim or there are prior arts (as far as our protocol is
> concerned).

I can't evaluate this without seeing the protocol.

-Ekr

Date: Sat, 01 Dec 2007 22:54:41 +0000
From: Alexey Melnikov <[email-masked]>
To: Yutaka OIWA <[email-masked]>
Subject: Re: [Ietf-http-auth] submitted draft-oiwa-http-mutualauth-01.txt
Cc: [email-masked]

Hi Yutaka,
[This might be slightly off-topic for this mailing list.]

Yutaka OIWA wrote:

>>4. I see you've filed an IPR disclosure on this technique. Is your
>>   own IPR the only IPR which you're aware of?
>>    
>>
>
>First, we can guarantee that the disclosed patents are the only patent
>that the authors (Oiwa, Watanabe, Takagi and Suzuki) have submitted or
>even concerned which affect the protocol.
>
>(Of course, the patent is only for the modification of the protocol
> from ISO specification and the application to HTTP authentication.
>  
>
Can you describe this in more details?
In particular, does your patent cover use of your authentication 
approach in protocols other than HTTP?

> The original ISO KAM3 protocol is out of the patent's scope for the
> obvious reason.)
>  
>

Date: Sat, 01 Dec 2007 20:51:29 +0000
From: Alexey Melnikov <[email-masked]>
To: Eliot Lear <[email-masked]>
Subject: Re: [Ietf-http-auth] Bar BoF in Vancouver?
Cc: [email-masked]

Eliot Lear wrote:

>Mark Nottingham wrote:
>  
>
>>How about Tuesday 6pm (unless ltans a potential conflict)?
>>    
>>
>Unfortunately everyone else wants to meet for a bar bof at that time :-(
>  
>
As long as this doesn't overrun the Vcarddav dinner happening later on 
Tuesday.
I believe some people might be interested in attending both.