Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-00.txt

From: [email-masked]
Date: Mon, 07 Oct 2013 14:43:51 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

	Title           : HTTP Digest Access Authentication
	Author(s)       : Rifaat Shekh-Yusef
                          David Ahrens
	Filename        : draft-ietf-httpauth-digest-00.txt
	Pages           : 28
	Date            : 2013-10-07

Abstract:
   HTTP provides a simple challenge-response authentication mechanism
   that may be used by a server to challenge a client request and by a
   client to provide authentication information. This document defines
   the HTTP Digest Authentication scheme that may be used with the
   authentication mechanism.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 7 Oct 2013 18:13:54 -0400

Hi,

We have submitted an initial version for the HTTP Digest draft that would
obsolete RFC2617.
We have included most of the digest text from RFC2617, with the following
changes:
1. Added Algorithm Agility support
2. Added I18N section
3. Included most of the Security Consideration text "as is" for now, with
some new text based on the discussion we had during the work on the Digest
Update draft.
4. Did not add the Sample Implementation section, as it is probably not
needed by now.

Please, take a look and let us know what you think.

Regards,
 Rifaat

On Mon, Oct 7, 2013 at 5:43 PM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 8 Oct 2013 09:15:37 +0300

> Please, take a look and let us know what you think.

Section 3.4.2: A1

> 'If the "algorithm" directive's value is "MD5-sess", "SHA2-256", or
> "SHA2-512-256", then[...]'

Should this be:

> 'If the "algorithm" directive's value is "MD5-sess", "SHA2-256-sess", or
> "SHA2-512-256-sess", then[...]'

?

-Ilari

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 8 Oct 2013 08:30:49 -0400

Good catch Ilari, thanks. I will fix that.

Regards,
 Rifaat

On Tue, Oct 8, 2013 at 2:15 AM, Ilari Liusvaara <[email-masked]
> wrote: