Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-05.txt

From: [email-masked]
Date: Wed, 12 Feb 2014 15:51:18 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : HTTP Digest Access Authentication
        Authors         : Rifaat Shekh-Yusef
                          David Ahrens
                          Sophie Bremer
	Filename        : draft-ietf-httpauth-digest-05.txt
	Pages           : 30
	Date            : 2014-02-12

Abstract:
   HTTP provides a simple challenge-response authentication mechanism
   that may be used by a server to challenge a client request and by a
   client to provide authentication information. This document defines
   the HTTP Digest Authentication scheme that may be used with the
   authentication mechanism.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-05

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 12 Feb 2014 18:55:42 -0500

Hi,

This new version of the draft addresses the latest comments with regards to
syntax, registration of the Authentication-Info header, text around
obsoleting RFC2617, and many editorials fixes.
We would appreciate any feedback on this latest version of the document.

Regards,
 Rifaat

On Wed, Feb 12, 2014 at 6:51 PM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Julian Reschke <[email-masked]>
Date: Thu, 13 Feb 2014 09:04:57 +0100

On 2014-02-13 00:55, Rifaat Shekh-Yusef wrote:
> Hi,
>
> This new version of the draft addresses the latest comments with regards
> to syntax, registration of the Authentication-Info header, text around
> ...

Two points after a quick read:

1) Your references to Internet Drafts should have the actual draft name 
in them (<seriesInfo name="Internet-Draft" value="draft-ietf..."/>).

2) You now cite RFC 5234 (good). RFC 2617 used an ABNF variant that used 
implied linear white space. Did you check that those ABNF productions 
that were carried over from 2617 are still correct?

Best regards, Julian

---

From: Paul Leach <[email-masked]>
Date: Thu, 13 Feb 2014 02:25:16 -0800

Note that in the following text from section 3.3, the algorithm is SHA-256,
yet the description refers to MD5. 

"For example:

           For the "SHA-256" and "SHA-256-sess" algorithms

               H(data) = SHA-256(data)

         i.e., the digest is the MD5 of the secret concatenated with a
         colon concatenated with the data. The "MD5-sess" algorithm is..."

> -----Original Message-----
> > This new version of the draft addresses the latest comments with
> > regards to syntax, registration of the Authentication-Info header,
> > text around obsoleting RFC2617, and many editorials fixes.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 13 Feb 2014 08:40:16 -0500

Thanks Paul,

I will fix that in the next version of the document.

Regards,
 Rifaat