Subject: [http-auth] I-D Action: draft-ietf-httpauth-mutual-01.txt

From: [email-masked]
Date: Mon, 21 Oct 2013 09:44:25 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

	Title           : Mutual Authentication Protocol for HTTP
	Author(s)       : Yutaka Oiwa
                          Hajime Watanabe
                          Hiromitsu Takagi
                          Tatsuya Hayashi
                          Yuichi Ioku
	Filename        : draft-ietf-httpauth-mutual-01.txt
	Pages           : 49
	Date            : 2013-10-21

Abstract:
   This document specifies a mutual authentication method for the Hyper-
   text Transfer Protocol (HTTP).  This method provides a true mutual
   authentication between an HTTP client and an HTTP server using
   password-based authentication.  Unlike the Basic and Digest
   authentication methods, the Mutual authentication method specified in
   this document assures the user that the server truly knows the user's
   encrypted password.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-mutual-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 22 Oct 2013 20:33:22 +0900

Dear httpauth WG people,

Thank you again for valuable feedback in the interim meeting.
I have quickly applied improvements for some of discussed issues.
(Possibly) most important changes are:
 * change on channel binding (host verification) mechanisms.
 * dropping UI requirements, replaced with non-normative,
    general security discussion in the security consideration sections.

I'd like to make more comprehensive changes including
style and text improvements as a -02 draft.
For a while on -01 draft, I'd like to have feedback on
several changes I made.
Change diffs are available at:
http://tools.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-01.txt

Some more issues are awaiting either my effort or WG discussions.
Sorry for making you waiting.

Thanks a lot,

Yutaka

2013/10/22  <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]