Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-update-00.txt

From: [email-masked]
Date: Mon, 10 Jun 2013 12:19:45 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

	Title           : HTTP Digest Update
	Author(s)       : Rifaat Shekh-Yusef
                          David Ahrens
	Filename        : draft-ietf-httpauth-digest-update-00.txt
	Pages           : 10
	Date            : 2013-06-10

Abstract:
   This documents specifies extensions to the HTTP Digest Authentication
   mechanism to add support for more digest algorithms to the HTTP
   Digest Access Authentication scheme.

   This document also specifies an extension to HTTP Digest
   Authentication mechanism to allow the server to indicate its
   character encoding support.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest-update

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-update-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Mon, 10 Jun 2013 23:14:52 +0000

Compared to the original draft, besides some editorial changes, I added an internationalization section that has the same text I sent to the mailing list on March 18.
I did not make any changes to the algorithm agility at this stage, as we need to conclude the discussion that has already started on the mailing list around this issue.

We would appreciate any further feedback on this document, especially around the i18n section.

Regards,
 Rifaat

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of [email-masked]
> Sent: Monday, June 10, 2013 3:20 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-update-
> 00.txt
> 
> 
>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Yoav Nir <[email-masked]>
Date: Tue, 11 Jun 2013 05:18:22 +0000

Thank you Rifaat and David for agreeing to edit this document for the working group.

I have opened our very first issue ( http://trac.tools.ietf.org/wg/httpauth/trac/ticket/1 ) on the tracker for the algorithm agility issue.

Yoav

---

From: Julian Reschke <[email-masked]>
Date: Tue, 11 Jun 2013 11:50:23 +0200

On 2013-06-11 01:14, Shekh-Yusef, Rifaat (Rifaat) wrote:
> ...

Well.

I don't think we have sufficient experience with fixing the I18N right 
away. This is why I have proposed to try this in a separate draft for 
now, and that's why we have draft-ietf-httpauth-basicauth-enc-00.

Similar arguments apply to Digest, and thus I'd recommend to leave the 
I18N issue alone until we are confident that the proposed fix indeed is 
going to work.

What's needed right now are test cases, experimentation, and bug fixes 
in browsers -- not a spec that we don't know is going to work in practice.

Best regards, Julian

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Tue, 11 Jun 2013 13:25:44 +0000

Thanks Julian,

I would be ok with creating a separate experimental document to specifically deal with the i18n for Digest.

Any other opinions on this issue?

Regards,
 Rifaat

> From: Julian Reschke [mailto:[email-masked]]
> Sent: Tuesday, June 11, 2013 5:50 AM
> To: Shekh-Yusef, Rifaat (Rifaat)
> Cc: [email-masked]
> Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-digest-update-
> 00.txt
> 
> > Compared to the original draft, besides some editorial changes, I
> added an internationalization section that has the same text I sent to
> the mailing list on March 18.
> > ...
> 
> Well.
>

---

From: Julian Reschke <[email-masked]>
Date: Tue, 11 Jun 2013 15:39:32 +0200

> Any other opinions on this issue?

Whatever the answer is, it would be good if it was the same for Basic 
and Digest :-)

Best regards, Julian

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 11 Jun 2013 07:09:21 -0700

On Jun 11, 2013, at 6:39 AM, Julian Reschke <[email-masked]> wrote:

> Whatever the answer is, it would be good if it was the same for Basic and Digest :-)

+1, and +1 to having it as a separate draft so that implementers see the emphasis on it being experimental. Like Julian, I am skeptical that we're going to get this right quickly.

--Paul Hoffman

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Tue, 11 Jun 2013 18:39:21 +0000

Well, Basic does not have the ability to negotiate a proper encoding, while Digest does not have that limitation.
Why would you limit Digest because of the Basic limitation?

Regards,
 Rifaat

> Sent: Tuesday, June 11, 2013 9:40 AM
> > I would be ok with creating a separate experimental document to
> specifically deal with the i18n for Digest.
> >

---

From: Julian Reschke <[email-masked]>
Date: Tue, 11 Jun 2013 20:46:43 +0200

> Why would you limit Digest because of the Basic limitation?

Well, Basic *could* negotiate (in that the server could state what it 
wants).

The key issue here is to find something that is as simple and possible 
*and* deployable in practice. Maybe the requirements for Digest are 
different, because (IMHO) it's not as widely used as Basic?

Best regards, Julian

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Tue, 11 Jun 2013 18:53:00 +0000

I will document both approaches in a new draft, and then open it for discussion.

Regards,
 Rifaat

> Sent: Tuesday, June 11, 2013 2:47 PM
> > Well, Basic does not have the ability to negotiate a proper encoding,
> while Digest does not have that limitation.