Subject: [http-auth] HTTP Digest - Algorithms Registry

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 11 Dec 2013 10:23:01 -0500

Hi,

To simplify the introduction of new algorithms in the future, e.g SHA3, I
was thinking that we could create a new IANA Registry to register the
algorithms that will be used with the HTTP Digest mechanism.

How difficult is the process of creating such a registry? is it worth the
effort?

I would appreciate any thoughts on this.

Thanks.
 Rifaat

---

From: Yoav Nir <[email-masked]>
Date: Thu, 12 Dec 2013 09:46:56 +0000

Hi Rifaat

Setting up a registry involves a paragraph in the IANA considerations of the draft.  See RFC 5226. It goes something like:

IANA is requested to set up a registry of strings representing the hash algorithm used in this protocol. The registry should be called "HTTP Digest Hash Algorithms", and each entry should consist of a string and a reference algorithm. The update policy for this registry shall be xxxxxxxxx. Initial allocation for this registry shall be the following strings: "MD5", "SHA1", and "SHA256", all should reference this document.

The harder part is deciding on the value of xxxxxxxxx up there. There are several options (see section 4.1). Here's those that might be relevant:

  *   First Come First Serve - Anyone can ask IANA to register their hash algorithm called "SHA5-1024"
  *   Expert Review - Someone will have to be appointed (by the ADs) to review all requests for allocation
  *   Specification Required - Anyone can ask IANA to register, but they need to provide a document (does not have to be an RFC) describing this new hash, and make it publicly available
  *   RFC Required - self-explanatory, no?  I can still develop SHA5-1024 on my own, and publish it in an Informational RFC.
  *   Standards Action - same as above, except the RFC has to be standards track

Wearing no hats, I would prefer that we piggyback someone else's registry of hashes. But if we have to do it, I'd go with "specification required".

Yoav

From: http-auth [mailto:[email-masked]] On Behalf Of Rifaat Shekh-Yusef
Sent: Wednesday, December 11, 2013 5:23 PM
To: [email-masked]
Subject: [http-auth] HTTP Digest - Algorithms Registry

Hi,

To simplify the introduction of new algorithms in the future, e.g SHA3, I was thinking that we could create a new IANA Registry to register the algorithms that will be used with the HTTP Digest mechanism.

How difficult is the process of creating such a registry? is it worth the effort?

Thanks.
 Rifaat

Email secured by Check Point

---

From: Yutaka OIWA <[email-masked]>
Date: Thu, 12 Dec 2013 21:10:50 +0900

If we need just a hash name, Alexey's SCRAM draft
refers to the IANA "Hash Function Textual Names".
It currently has entries md2, md5, sha-1, sha-224, sha-256,
sha-384 and sha-512.

2013/12/12 Rifaat Shekh-Yusef <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Harry Halpin <[email-masked]>
Date: Thu, 12 Dec 2013 13:18:36 +0100

On 12/11/2013 04:23 PM, Rifaat Shekh-Yusef wrote:
> Hi,
>
> To simplify the introduction of new algorithms in the future, e.g 
> SHA3, I was thinking that we could create a new IANA Registry to 
> register the algorithms that will be used with the HTTP Digest mechanism.
>

For more complex parameters, JOSE WG is working on specifying a 
registry. I think it's still in progress, but we in the Web Crypto are 
planning to use that registry so each spec doesn't have a separate 
registry for the sam crypto primitives.

    cheers,
       harry

---

From: Yoav Nir <[email-masked]>
Date: Thu, 12 Dec 2013 13:21:29 +0000

Unfortunately, RFC 2617 uses "MD5" (uppercase), while that registry has "md5" (lowercase).

I'm tempted to suggest that we use the strings from that registry, but convert them to uppercase and optionally add "-sess". If anybody then registers both sha3-256 and SHA3-256, we're screwed.

Yoav

---

From: Julian Reschke <[email-masked]>
Date: Thu, 12 Dec 2013 14:35:56 +0100

On 2013-12-12 14:21, Yoav Nir wrote:
> ...

Or we could update RFC 4572 stating that the strings are indeed 
(usascii)-case-insensitive.

Best regards, Julian

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 12 Dec 2013 08:54:57 -0500

Thanks Harry,

Do they have a draft that describes their registry already?

Regards,
 Rifaat

On Thu, Dec 12, 2013 at 7:18 AM, Harry Halpin <[email-masked]> wrote:

>  To simplify the introduction of new algorithms in the future, e.g SHA3,
> I was thinking that we could create a new IANA Registry to register the
> For more complex parameters, JOSE WG is working on specifying a registry.
> I think it's still in progress, but we in the Web Crypto are planning to
> use that registry so each spec doesn't have a separate registry for the sam
> crypto primitives.
>
>    cheers,
>       harry
>
>
> http-auth mailing [email-masked]://www.ietf.org/mailman/listinfo/http-auth
>
>
>