Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-04.txt

From: [email-masked]
Date: Sun, 19 Jan 2014 11:46:21 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : HTTP Digest Access Authentication
        Authors         : Rifaat Shekh-Yusef
                          David Ahrens
                          Sophie Bremer
	Filename        : draft-ietf-httpauth-digest-04.txt
	Pages           : 30
	Date            : 2014-01-19

Abstract:
   HTTP provides a simple challenge-response authentication mechanism
   that may be used by a server to challenge a client request and by a
   client to provide authentication information. This document defines
   the HTTP Digest Authentication scheme that may be used with the
   authentication mechanism.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sun, 19 Jan 2014 14:50:49 -0500

Hi,

Thank you all for great comments; we really appreciate that.
We believe that we addresses all the latest comments, and we also expanded
the examples section.

Please, take a look and let us know if you have any further comments.

Regards,
 Rifaat

On Sun, Jan 19, 2014 at 2:46 PM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Julian Reschke <[email-masked]>
Date: Mon, 20 Jan 2014 16:59:58 +0100

On 2014-01-19 20:50, Rifaat Shekh-Yusef wrote:
> We believe that we addresses all the latest comments, and we also
> expanded the examples section.
>
> ...

In 
<http://trac.tools.ietf.org/html/draft-ietf-httpauth-digest-04#section-3.5>, 
you have:

            AuthenticationInfo = "Authentication-Info" ":" auth-info
            auth-info          = 1#(nextnonce | [ message-qop ]
                                   | [ response-auth ] | [ cnonce ]
                                   | [nonce-count] )
            nextnonce          = "nextnonce" "=" nonce-value
            response-auth      = "rspauth" "=" response-digest
            response-digest    = <"> *LHEX <">

However the spec never says what ABNF notation it uses.

It *should* use RFC 5234, potentially using the extensions in 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-25.html#abnf.extension>.

Please also keep in mind that we don't use implied whitespace anymore, 
and follow the guidelines in 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-25.html#considerations.for.new.header.fields>.

Finally, you'll need to update the IANA registration for the header field.

Best regards, Julian