Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-update-04.txt

From: [email-masked]
Date: Sat, 13 Jul 2013 07:39:48 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

	Title           : HTTP Digest Update
	Author(s)       : Rifaat Shekh-Yusef
                          David Ahrens
	Filename        : draft-ietf-httpauth-digest-update-04.txt
	Pages           : 10
	Date            : 2013-07-13

Abstract:
   This documents specifies extensions to the HTTP Digest Authentication
   mechanism to add support for new digest algorithms to the HTTP Digest
   Access Authentication scheme.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest-update

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-update-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-update-04

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sat, 13 Jul 2013 10:47:30 -0400

Hi,

I have just submitted version 4 that fixed a reference to a FIPS document,
added a reference to SHA2-512/256, corrected the algorithm in the example,
and added a note in section 3.4 around the level of support for the
SHA2-512/256
algorithm.
I would appreciate any feedback on this version of the draft.

Regards,
 Rifaat

On Sat, Jul 13, 2013 at 10:39 AM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 13 Jul 2013 22:31:10 +0300

Hi Rifaat,

thanks for the update!

"NOTE: There is some concern around the support for the SHA2-512/256 
algorithm in the common implementation of SHA2."

I have looked at OpenSSL (the code tree) and GnuTLS (documentation), and 
unless I'm missing something, neither of them implements SHA2-512/256. 
If this is indeed the case, then this algorithm is not a good choice.

Thanks,
	Yaron

On 2013-07-13 17:47, Rifaat Shekh-Yusef wrote:
> Hi,
>
> I have just submitted version 4 that fixed a reference to a FIPS
> document, added a reference to SHA2-512/256, corrected the algorithm in
> the example, and added a note in section 3.4 around the level of support
> for the SHA2-512/256 algorithm.
> On Sat, Jul 13, 2013 at 10:39 AM, <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>     [email-masked] <mailto:[email-masked]>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sat, 13 Jul 2013 21:53:55 -0400

Thanks for looking into this Yaron,

All,

Should we then use SHA2-512 instead?

Regards,
 Rifaat

On Sat, Jul 13, 2013 at 3:31 PM, Yaron Sheffer <[email-masked]>wrote:

> unless I'm missing something, neither of them implements SHA2-512/256. If
> this is indeed the case, then this algorithm is not a good choice.
>
> Thanks,
>         Yaron
>
>
>> <mailto:internet-drafts@ietf.**org <[email-masked]>>> wrote:
>>
>>
>>              Filename        : draft-ietf-httpauth-digest-**update-04.txt
>>              Pages           : 10
>>              Date            : 2013-07-13
>>
>>     Abstract:
>>     https://datatracker.ietf.org/**doc/draft-ietf-httpauth-**
>> digest-update<https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest-update>
>>
>>     http://tools.ietf.org/html/**draft-ietf-httpauth-digest-**update-04<http://tools.ietf.org/html/draft-ietf-httpauth-digest-update-04>
>>
>>     http://www.ietf.org/rfcdiff?**url2=draft-ietf-httpauth-**
>> digest-update-04<http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-update-04>
>>
>>
>>     ftp://ftp.ietf.org/internet-**drafts/<ftp://ftp.ietf.org/internet-drafts/>
>>
>>     ______________________________**_________________
>>     http-auth mailing list
>>     https://www.ietf.org/mailman/**listinfo/http-auth<https://www.ietf.org/mailman/listinfo/http-auth>
>>
>>
>>
>>
>>
>> ______________________________**_________________
>> http-auth mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/**listinfo/http-auth<https://www.ietf.org/mailman/listinfo/http-auth>
>>
>>