Subject: [http-auth] Evaluation Criteria for the experimental drafts

From: Yoav Nir <[email-masked]>
Date: Wed, 28 Aug 2013 09:05:44 +0000

Hi

As we talked in Berlin, the following is not a checklist. It is meant only as guidance. Comments that are not covered by these guidelines are very welcome. 

Security:
   - No vulnerabilities that we should find
   - Assumptions, limitations should be stated up front, not left to security considerations
     For example, a method that requires secure storage of password equivalents should state this up front.

Clarity:
   - Can a reasonably competent developer implement this after reading this document.

Requirements and Assumptions about the operating environment:
   - It's OK to have them, but they MUST be stated.
   - Especially look for demands for other network components (such as AAA servers), hardware tokens, UI elements

Performance:
   - Shouldn't be a problem.

Yoav