Subject: [http-auth] Ticket #1 - Determine Algorithm Agility in digest-update

From: Yoav Nir <[email-masked]>
Date: Thu, 22 Aug 2013 07:37:35 +0000

Hi

Ticket #1 ( http://trac.tools.ietf.org/wg/httpauth/trac/ticket/1 ) covers the question of algorithm agility in digest-update.

The current draft has SHA-256 as the primary algorithm, SHA-512/256 as the secondary algorithm, and MD5 for BC.
There is text that instructs the UA to ignore unrecognized algorithms, and move on to similar headers with recognized algorithms, and also to choose the most preferred algorithm, so future compatibility (the ability to add new algorithms later) is (I think) addressed.

There were concerns that SHA-512/256 is not widely implemented, but Tony Hansen said (in Berlin) that he's working on updating RFC 6234 to add this. An implementer (me!) said at the meeting that adding SHA-512/256 to a code-base that already had SHA-512 was trivial.

Given all that, can we close this ticket as solved, or are there still objections to the algorithm agility text?

Thanks

Yoav

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 27 Aug 2013 09:16:17 -0400

Yeah, based on the meeting in Berlin, I think it makes sense to close this
ticket.

Regards,
 Rifaat

On Thu, Aug 22, 2013 at 3:37 AM, Yoav Nir <[email-masked]> wrote:

> Hi
>
> Ticket #1 ( http://trac.tools.ietf.org/wg/httpauth/trac/ticket/1 ) covers
> the question of algorithm agility in digest-update.
>
> There is text that instructs the UA to ignore unrecognized algorithms, and
> move on to similar headers with recognized algorithms, and also to choose
> the most preferred algorithm, so future compatibility (the ability to add
> new algorithms later) is (I think) addressed.
>
> There were concerns that SHA-512/256 is not widely implemented, but Tony
> Hansen said (in Berlin) that he's working on updating RFC 6234 to add this.
> An implementer (me!) said at the meeting that adding SHA-512/256 to a
> code-base that already had SHA-512 was trivial.
>
> Given all that, can we close this ticket as solved, or are there still
> objections to the algorithm agility text?
>
> Thanks
>
> Yoav
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>