Subject: Re: [http-auth] Draft Minutes Posted for IETF 87 HTTP-AUTH Session

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Sep 2013 09:44:55 +0200

On 2013-08-21 21:22, Matthew Lepinski wrote:
> Draft minutes for the HTTP-AUTH session have been posted.
>
> They can be found at:
> http://www.ietf.org/proceedings/87/minutes/minutes-87-httpauth
>
> If you notice any omissions or other errors in the minutes, please let
> us know.
> ...

Those say:

> -- The cognizant Security Area Director (Sean Turner) has a strong preference for making the Basic and Digest Authentication drafts Standards Track (as opposed to experimental). The chairs will work with the authors to make this happen.

My recollection is that Sean asked for having a standards-level track 
replacement for "Basic", not just the "fix" for I18N -- so an entirely 
different document.

Best regards, Julain

---

From: Yoav Nir <[email-masked]>
Date: Tue, 3 Sep 2013 16:20:06 +0000

On Sep 3, 2013, at 10:44 AM, Julian Reschke <[email-masked]> wrote:

> My recollection is that Sean asked for having a standards-level track replacement for "Basic", not just the "fix" for I18N -- so an entirely different document.

After checking with Sean, you're right. In fact, that's what the charter says. So for the next iteration of the draft:
 - please make it "standard track"
 - copy over the relevant parts from RFC2617, updating as needed.

That last part shouldn't be too onerous, as most of the stuff there is related to Digest rather than Basic.

For Digest we'll have to be more selective. I think that because of the obvious weakness - the vulnerability to dictionary attacks, we could condense the digest security considerations quite a bit, but I guess we'll see about that.

Yoav

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Sep 2013 18:42:37 +0200

>   - copy over the relevant parts from RFC2617, updating as needed.

Actually, it'll be a different draft; I don't think there's any point in 
pretending it's a successor to what I have now.

> For Digest we'll have to be more selective. I think that because of the obvious weakness - the vulnerability to dictionary attacks, we could condense the digest security considerations quite a bit,…

I expect I'll need somebody's hand-holding to come up with appropriate 
text for the Security Considerations.

Best regards, Julian

---

From: Yoav Nir <[email-masked]>
Date: Tue, 3 Sep 2013 17:58:02 +0000

On Sep 3, 2013, at 7:42 PM, Julian Reschke <[email-masked]> wrote:

> Actually, it'll be a different draft; I don't think there's any point in pretending it's a successor to what I have now.

OK. You can still use the same filename, if you want.

> I expect I'll need somebody's hand-holding to come up with appropriate text for the Security Considerations.

Hmm, security considerations for sending your secret credential in the clear to a random host on the Internet?  Easy. One word. "Don't.". But I guess we'll want something more, so here's my suggested text:

For the authentication method specified in this document, a secret credential is sent from client to server. The Basic authentication method provides no secrecy for this credential. For this reason, it is important that the authentication run over a secure channel, usually provided using TLS. Note that mere use of TLS does not guarantee confidentiality for the credential, so the client MUST know the intended server identity prior to beginning the protocol, and MUST verify that identity according to section 3.1 of [RFC2818].

Yoav

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 4 Sep 2013 16:16:21 -0400

On Tue, Sep 3, 2013 at 12:20 PM, Yoav Nir <[email-masked]> wrote:

> >> -- The cognizant Security Area Director (Sean Turner) has a strong
> preference for making the Basic and Digest Authentication drafts Standards
> Track (as opposed to experimental). The chairs will work with the authors
> to make this happen.
> >
> After checking with Sean, you're right. In fact, that's what the charter
> says. So for the next iteration of the draft:
> For Digest we'll have to be more selective. I think that because of the
> obvious weakness - the vulnerability to dictionary attacks, we could
> condense the digest security considerations quite a bit, but I guess we'll
> see about that.
>

Yoav,

I am not clear on this; are you saying that Sean's request is for the
Digest document to deprecate the Digest mechanism defined in RFC2617 and
include all the details of that mechanism in this draft?

Regards,
 Rifaat

> Yoav
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Julian Reschke <[email-masked]>
Date: Thu, 12 Sep 2013 12:35:09 +0200

> If you notice any omissions or other errors in the minutes, please let

OK, the minutes mention:

"Unicode Normalization : Getting from what is typed in to Unicode code 
points will require discussion"

So how do we proceed from here? Any concrete proposals for what to say?

Best regards, Julian