Subject: Re: [http-auth] charter rev -03

From: Sean Turner <[email-masked]>
Date: Mon, 04 Feb 2013 10:02:49 -0500

On 1/28/13 10:17 AM, Stephen Farrell wrote:
>
>
> On 01/28/2013 02:24 PM, Sean Turner wrote:
>> Right so the plan here is to put this on the BOF list with the hope that
>> a WG will get formed before IETF 86.  Obviously this plan is predicated
>> on more expressions of support for the proposed charter.
>
> As a draft author, I think forming a wg with this charter
> would be good. (As an IESG member, I'll be recusing myself
> from IESG balloting on this.)

Just to be clear, it's time to speak up if you support the idea of 
forming a WG because silence means we shelve the idea.

spt

---

From: Nico Williams <[email-masked]>
Date: Mon, 4 Feb 2013 09:06:31 -0600

I support forming this WG.

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 04 Feb 2013 17:10:09 +0200

+1.

	Yaron

On 02/04/2013 05:06 PM, Nico Williams wrote:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Thomas Fossati <[email-masked]>
Date: Mon, 4 Feb 2013 15:56:51 +0000

On Mon, Feb 4, 2013 at 3:02 PM, Sean Turner <[email-masked]> wrote:
> Just to be clear, it's time to speak up if you support the idea of forming a
> WG because silence means we shelve the idea.

(Strongly) in favour of the creation of this WG.

---

From: Michael Thomas <[email-masked]>
Date: Mon, 04 Feb 2013 08:39:47 -0800

> I support forming this WG.

  +1

Mike

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 4 Feb 2013 22:26:54 +0200

> forming a WG because silence means we shelve the idea.

+1 for forming a WG.

I think HTTP-level authentication has been negelected for too long
already.

-Ilari

---

From: "HAYASHI, Tatsuya" <[email-masked]>
Date: Tue, 5 Feb 2013 22:06:05 +0900

+1 for forming a WG.

--
HAYASHI, Tatsuya
Lepidum Co. Ltd.

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 5 Feb 2013 22:27:52 +0900

Dear Sean,

> WG because silence means we shelve the idea.

+1, supportive to form a WG.

# just as a re-clarification of my mail on Jan 24th...

-- 
Yutaka OIWA, Ph.D.              Leader, Software Reliability Research Group
                             Research Institute for Secure Systems (RISEC)
   National Institute of Advanced Industrial Science and Technology (AIST)
                     Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Harry Halpin <[email-masked]>
Date: Tue, 05 Feb 2013 15:40:22 +0100

+1, and happy to serve to co-ordinate with W3C and browser folks in this 
area.

We're having an "all hands-on deck" W3C Working Group session in late 
April that I can run the idea by them.

Overall, I think there's a very strong desire for a  HTTPAuth with a SRP 
protocol in a few coding projects, including one I'm involved with with 
the LEAP hat on [1]. So I know there's at least one large-scale, 
multi-thousand person user-base that wants this.

        cheers,
                harry

[1] https://leap.se/en

---

From: Yoav Nir <[email-masked]>
Date: Tue, 5 Feb 2013 14:42:46 +0000

On Feb 4, 2013, at 5:02 PM, Sean Turner <[email-masked]> wrote:

> Just to be clear, it's time to speak up if you support the idea of forming a WG because silence means we shelve the idea.

It seems like we have enough people, including enough people willing to work on things. 

I am still not convinced that any of these proposals will ever see any implementation. We may very well be creating a series of vanity RFCs.

That said, while running code is a goal, the important consideration for forming a working group is the availability of people and time to do the work. This is available here, so I support forming the working group.

Yoav

---

From: Harry Halpin <[email-masked]>
Date: Tue, 05 Feb 2013 15:52:09 +0100

> I am still not convinced that any of these proposals will ever see any implementation. We may very well be creating a series of vanity RFCs.

  Is anyone on this mailing list working on a browser?

  If not, we should do the outreach.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 5 Feb 2013 10:24:56 -0500

On Tue, Feb 5, 2013 at 9:52 AM, Harry Halpin <[email-masked]> wrote:

>> I am still not convinced that any of these proposals will ever see any
>> implementation. We may very well be creating a series of vanity RFCs.
>>
>

I think Web browsing is pretty much water under the bridge at this point.
It is possible to change the Web browsing scheme but any scheme that does
so has to find a killer app outside Web browsing first.

Web services are a different matter. There are hundreds being defined each
week. Pretty much every single one needs an authentication layer and HTML
forms won't work for that.

What might be feasible is to get SAML and OAuth and OpenID to agree on
using the HTTP auth scheme for authentication to the identity provider in
place of the cookie based schemes that are currently in place.

It is also possible that a 'hard cookie' that is a direct replacement for a
traditional HTTP authentication cookie but is not passed as a bearer token
and so is resistant to various MITM schemes would find favor.

I would not expect the browser providers to drive this effort though. My
experience there is that is pretty much the 'bring me a rock' school of
management where they will give little input as to what sort of rock they
want up front but tell you that its the wrong rock afterwards.

-- 
Website: http://hallambaker.com/

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Feb 2013 07:50:24 -0800

> That said, while running code is a goal, the important consideration for forming a working group is the availability of people and time to do the work. This is available here, so I support forming…

+1, +1, +.5

--Paul Hoffman

---

From: Julian Reschke <[email-masked]>
Date: Tue, 05 Feb 2013 16:54:04 +0100

On 2013-02-05 16:24, Phillip Hallam-Baker wrote:
>
>
> On Tue, Feb 5, 2013 at 9:52 AM, Harry Halpin <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>         On Feb 4, 2013, at 5:02 PM, Sean Turner <[email-masked]
>         <mailto:[email-masked]>> wrote:
>
>             Just to be clear, it's time to speak up if you support the
>             idea of forming a WG because silence means we shelve the idea.
>
>
>         I am still not convinced that any of these proposals will ever
>         see any implementation. We may very well be creating a series of
>         vanity RFCs.
>
>
> I think Web browsing is pretty much water under the bridge at this
> point. It is possible to change the Web browsing scheme but any scheme
> that does so has to find a killer app outside Web browsing first.
> ...

Hmm. The charter contains:

> In addition, the WG will aim to get rough consensus on two drafts that
> will obsolete the basic and digest schemes defined in RFC 2617 taking
> into account errata on that specification.
>
> For the digest scheme, "more modern" algorithm agility and
> internationalisation support will be developed as a standards-track
> RFC. The starting point for this will be
> draft-ahrens-httpbis-digest-auth-update, but the WG is not precluded
> from e.g. adding a Diffie-Hellman exchange to this method.
>
> For the basic scheme, no technical changes are envisaged other than to
> handle i18n of usernames and passwords, the goal will simply be to
> improve the documentation of the scheme to allow obsoleting RFC 2617
> which has some significant flaws when looked back at 13 years later.

It should be our goal to get at least these implemented in browsers.

Best regards, Julian

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Feb 2013 08:04:07 -0800

> It should be our goal to get at least these implemented in browsers.

+1. It is inappropriate to suggest otherwise.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 5 Feb 2013 11:24:48 -0500

Who ever appointed you to say what is appropriate or not?

Nobody, that is who.

Now I would let it slide only you spend a lot of your time making snippy
comments accusing others of this behavior.

Moreover, you are misrepresenting what I said which was not 'we should not
try' but 'don't expect to see the browser people participate' and in
particular 'don't gate on the browser people providing input'.

Which is another thing you spend rather too much time policing.

---

From: Nico Williams <[email-masked]>
Date: Tue, 5 Feb 2013 10:30:31 -0600

> +1. It is inappropriate to suggest otherwise.

+1.  And non-browser clients.  And (of course) servers.

IMO we must also pursue a generic session continuation protocol as proposed
many times recently in various fora, preferably in the WEBSEC WG.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Tue, 5 Feb 2013 10:30:47 -0600

Nico
--

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 5 Feb 2013 11:42:27 -0500

I think that it needs to be clear that we are currently in a charter
discussion and that this is still an proposal.

It is thus entirely appropriate to suggest that the focus of this work
should be enabling Web Service interactions which represents a 'green
field' site for development rather than trying to propose a mechanism to
replace the legacy Web browser base.

While I would like to do the second, I don't want anyone to judge the
success of the group by the likelihood they would deliver in that
particular area.

On Sun, Jan 13, 2013 at 12:35 PM, Stephen Farrell <[email-masked]
> wrote:

>
> Hi all and happy new year,
>
> Sorry to have done nothing since mid-Nov on this, but I've
> finally gotten around to going back over the list traffic
> and modified the text to make the attached -03 version of
> the charter.
>
> I think this one is good enough to hand over to Sean to see
> what he wants to do about it, that is, I don't see it getting
> way way better due to mail on this list, so I reckon we're
> done for now, and its over to Sean to see what he thinks.
>
> Cheers,
> S.
>
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 05 Feb 2013 16:53:27 +0000

Hi Phill,

Actually I think we're all really agreeing about what's
doable and what's not, even you and Paul:-)

Nobody here (afaik) thinks we're gonna get browsers to
immediately adopt any lovely new fangled experimental stuff
that's proposed. If non-browsers do adopt then that's
great and we'll see where it goes.

For the two things Julian mentioned we would like browsers
to adopt them if we do a good job, hence it seems reasonable
to try progress those on the standards track.

If there are charter text changes that you want to
suggest then please do so, but I think the -03 version
captures the above already.

And of course, if Sean decides to take this further then
there'll be more opportunities to comment and propose
changes as the charter is reviewed.

Cheers,
S.

---

From: "Henry B. Hotz" <[email-masked]>
Date: Tue, 5 Feb 2013 09:45:17 -0800

+1

However I have not heard any answer addressing the original question, which would seem to be a prerequisite.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

On Feb 5, 2013, at 8:30 AM, Nico Williams <[email-masked]> wrote:

> IMO we must also pursue a generic session continuation protocol as proposed many times recently in various fora, preferably in the WEBSEC WG.
> 
> Nico
> --

---

From: Cameron Jones <[email-masked]>
Date: Tue, 5 Feb 2013 18:40:55 +0000

>  If not, we should do the outreach.
This was briefly skimmed over in the HTML WG F2F in Lyon, November 2012
where Henri from Mozilla indicated that they would potentially be
interested in implementing new HTTP Auth schemes. That was pretty much the
sum of it. He also indicated that they're quite keen on their BrowserID
mechanism. Without wanting to speak for him any more, i'd think they might
be happy for the outreach.

I think largely what is in demand, based on other input to the HTML group,
is a SRP-style protocol to protect against server password leaks. The
negotiation process should be enough for a new protocol to be trickle
adopted, however there is a slight problem for existing organizations -
when would they delete their old databases and thus realize the benefits of
the protocol? The other aspects of zero-knowledge password proofs would
probably outweigh this enough for adoption tho, especially if there is
strong consumer demand driven by more frequent breaches, but perhaps the
horse bolted long ago for organizations interested in complete
zero-knowlege with persistent backwards compatibility - ie6 grips hold of
what life it had with a vengeance.

Thanks,
Cameron Jones

---

From: Cameron Jones <[email-masked]>
Date: Tue, 5 Feb 2013 18:51:02 +0000

On Mon, Feb 4, 2013 at 3:02 PM, Sean Turner <[email-masked]> wrote:

> Just to be clear, it's time to speak up if you support the idea of forming
> a WG because silence means we shelve the idea.
>
> spt
>

+1

Thanks,
Cameron Jones

---

From: Jim Fenton <[email-masked]>
Date: Tue, 05 Feb 2013 10:51:31 -0800

> forming a WG because silence means we shelve the idea.

Unfortunately, given the scope limitations of this charter (in
particular, the exclusion of mechanisms that aren't tied directly to
HTTP), I can't support formation of a WG.  Which is not to say that I
oppose it, but rather that I can't justify the time to participate in it.

One thing I don't see in the charter is a rationale for why HTTP
authentication should be preferred over the pervasive "web"
authentication currently being done.  If there are better HTTP
authentication schemes (and I agree, the current selection of schemes is
very limited), will HTTP authentication be widely deployed?

-Jim

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 5 Feb 2013 14:28:16 -0500

> doable and what's not, even you and Paul:-)

That is my understanding to.

What I objected to was Paul's assertion that raising that set of concerns
was inappropriate.

> great and we'll see where it goes.

I don't think we will get the browsers to lend their weight to make the
proposal a success. But I think they are quite likely to get involved if
they get the idea that a proposal might be a success without their
participation and eventually require them to implement a standard that is
not ideally suited to browser needs.

I don't think we can or should try to replace Web authentication schemes
(OpenID, SAML, OAuth). But we can and should provide capabilities that
would allow those schemes to be simpler and work better. As currently
written the charter looks to me like it is proposing to start a group that
will try to work on its own in a vacuum rather than something that could be
built on by other groups.

> captures the above already.

I would like the charter to better define the part of the authentication
process it is going to support. Simply saying 'authentication' does not
tell me which problems are in scope and which are not.

Digest Authentication actually has three parts:

1) Credential issue - user and service agree a symmetric key. This is
performed out of band.

2) Credential negotiation - user attempts to connect to the service, is
told authentication is required

3) Session continuation - authenticated messages are exchanged.

In my view as an author, the spec is defective in the following ways:

A) There is no provision for using public key cryptography which was
encumbered at the time the design was first proposed.

B) There is no provision for binding to TLS or other channel authentication

C) The negotiation mechanism and message authentication mechanism are
conflated in a confused way. This makes using the mechanism to authenticate
server responses unattractive.

D) Every existing implementation is vulnerable to a downgrade attack.

Z) The cryptographic algorithm used (PHB-MAC-MD5) is rather unfashionable

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 6 Feb 2013 07:36:58 +1100

+1.

Having the conversation dominated by experimental schemes that the browsers aren't interested in is also going to make this discussion harder for them to participate in.

OTOH, two major browsers are Open Source projects; has anyone committed to keeping patches for them up-to-date, at least? 

--
Mark Nottingham   http://www.mnot.net/

---

From: Yoav Nir <[email-masked]>
Date: Tue, 5 Feb 2013 20:56:31 +0000

> OTOH, two major browsers are Open Source projects; has anyone committed to keeping patches for them up-to-date, at least? 

AFAIK, out of the proposals that we've heard in Atlanta, only one (mutualAuth) has been implemented in a browser, and that was a patch over Firefox 3.5 (current version is 18)

Yoav

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 6 Feb 2013 08:06:54 +1100

> AFAIK, out of the proposals that we've heard in Atlanta, only one (mutualAuth) has been implemented in a browser, and that was a patch over Firefox 3.5 (current version is 18)

I meant the basic / digest revisions specifically.  I.e., if we're going to replace 2617's schemes, the replacements should have at least SOME connection to implementation.

---

From: Julian Reschke <[email-masked]>
Date: Tue, 05 Feb 2013 22:19:15 +0100

> I meant the basic / digest revisions specifically.  I.e., if we're going to replace 2617's schemes, the replacements should have at least SOME connection to implementation.

I was planning to implement draft-reschke-basicauth-enc in Mozilla, but 
that requires writing a sane WWW-A header field parser first. See test 
cases at <http://greenbytes.de/tech/tc/httpauth/>.

Best regards, Julian

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 05 Feb 2013 22:26:46 +0000

Hi Cameron,

On 02/05/2013 06:40 PM, Cameron Jones wrote:
> is a SRP-style protocol to protect against server password leaks. 

I don't think that works quite as you stated above.

Passwords leak from databases or keyboards and not via sniffing in
afaik pretty much all cases and strong password protocols still
have dictionary attackable password verifier databases.

There may still be good reasons to use a strong password protocol
like SRP or EKE or whatever of course and I've nothing against
'em, (some are really elegant), but we'd want to be clear about
what problems they do and don't address.

But that's getting ahead of ourselves probably.

S.

---

From: "SHIMIZU, Kazuki" <[email-masked]>
Date: Wed, 6 Feb 2013 21:28:26 +0900

+1

-- 
--
SHIMIZU, Kazuki

---

From: Cameron Jones <[email-masked]>
Date: Wed, 6 Feb 2013 13:18:21 +0000

> But that's getting ahead of ourselves probably.
Hey Stephen,

Yes, I wasn't trying to overstate a demand for SRP or other zero-knowledge
password protocols above all else, more that there was a vocal demand for
such. The requests were triggered by the various unsalted password database
leaks\hack & grabs last year.

Personally i too find the mechanism elegant and potentially highly valuable
for some scenarios, but the migration for existing password-knowledgable
systems seems to be a significant hurdle in achieving that utopian ideal.

Thanks,
Cameron Jones

---

From: "Ahrens, David (David)" <[email-masked]>
Date: Wed, 6 Feb 2013 15:38:31 +0000

+1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of SHIMIZU, Kazuki
Sent: Wednesday, February 06, 2013 4:28 AM
To: Sean Turner
Cc: [email-masked]
Subject: Re: [http-auth] charter rev -03

+1

2013/2/5 Sean Turner <[email-masked]>:
>>> Right so the plan here is to put this on the BOF list with the hope 
>>> that a WG will get formed before IETF 86.  Obviously this plan is 
>>> predicated on more expressions of support for the proposed charter.
>>
>>
>> As a draft author, I think forming a wg with this charter would be 
>> good. (As an IESG member, I'll be recusing myself from IESG balloting 
>> on this.)
>
>

---

From: Yutaka OIWA <[email-masked]>
Date: Thu, 7 Feb 2013 11:19:39 +0900

> AFAIK, out of the proposals that we've heard in Atlanta, only one (mutualAuth) has been implemented in a browser, and that was a patch over Firefox 3.5 (current version is 18)

The FF implementation is available on
<https://www.rcis.aist.go.jp/special/MutualAuth/index-en.html>.
We're currently implementing the protocol also on Chromium source codes.

---

From: "KIHARA, Boku" <[email-masked]>
Date: Thu, 7 Feb 2013 19:00:09 +0900

+1.