Subject: [http-auth] Minutes for October 8 Interim Meeting

From: Matthew Lepinski <[email-masked]>
Date: Sun, 27 Oct 2013 23:16:03 -0400

I am having some trouble getting this uploaded to the Proceedings site
(hopefully they will appear there soon).

However, here is a set of minutes for the October 8th Interim meeting.
Please let us know if there are any errors.

Thanks,
- Yoav and Matt

---

From: Yutaka OIWA <[email-masked]>
Date: Mon, 28 Oct 2013 21:30:05 +0900

Dear Matthew,

thank you very much for taking the minutes!
As an author of the draft,
I found no significant issues there.

There are several issues waiting my responses,
for which I will send more detailed text there.
Here is a quick response for some of these issues:

> ISSUE #2: The authors are hesitant to use the mechanism in RFC 5929
> because they are concerned about the adoption status of RFC 5929 and
> don't want a dependency on RFC 5929 to hinder implementation of the
> mutal-auth mechanism. Several working group participants feel quite
> strongly that RFC 5929 is the future, and that HTTPAUTH is well-served
> to use the already-standardized channel binding mechanism.

At this moment, "The authors were hesitant" became more appropriate :-)
At the end of the discussion, I was finally convinced to
the WG participants' idea mostly.
I already posted -01 draft which has incorporated proposed changes.

The discussion within the interim meeting gave me
several good suggestive information to me, which removed
most of my concern for running-code principle regarding it.
Shortly, I am satisfied for being sure that, if we just implement it,
it's enough, and people will not likely to call it unimplementable.
So I have currently no more strong concern on adopting RFC 5929.
Thank you very much for good suggestions.

# There is one small pending issue there, for which I had already written
# separately for deciding final adoption.

> ISSUE #5: The next version of the Mutual-Auth draft will incorporate
> the idea of how long the server should keep session information

One correction from my side: there was already a feature which seems
mostly equivalent to the requested one (time field).
So I did not added any new feature for the -01 draft.
If my understanding for the requested feature was wrong,
please let me know and I will fix it.

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]