Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-06.txt

From: [email-masked]
Date: Wed, 09 Apr 2014 16:39:40 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : HTTP Digest Access Authentication
        Authors         : Rifaat Shekh-Yusef
                          David Ahrens
                          Sophie Bremer
	Filename        : draft-ietf-httpauth-digest-06.txt
	Pages           : 30
	Date            : 2014-04-09

Abstract:
   HTTP provides a simple challenge-response authentication mechanism
   that may be used by a server to challenge a client request and by a
   client to provide authentication information. This document defines
   the HTTP Digest Authentication scheme that may be used with the
   authentication mechanism.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-06

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 9 Apr 2014 19:42:18 -0400

Hi,

This new version of the draft addresses all the comments received during
the last IETF meeting and based on my response to the Minutes of the
meeting.
Please, take a look and let us know if you have any comments.

Regards,
 Rifaat

On Wed, Apr 9, 2014 at 7:39 PM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 Apr 2014 07:33:09 +0300

Thanks, Rifaat

Two comments:

1. Section 3.7 still lists algorithms in order of preference. While this refers only to algorithms specified in this specification, and not to any other algorithms someone might add, I’m not sure we really need this. How about this:

OLD:
   This specification defines the following preference list, starting
   with the most preferred algorithm:

      * SHA2-256
      * SHA2-512/256
      * MD5 (for backward compatibility).

NEW:
   This specification defines the following algorithm:

      * SHA2-256 (mandatory to implement)
      * SHA2-512/256 (as a backup algorithm)
      * MD5 (for backward compatibility).

2. In section 6.1 you have the initial registry with a column for “Digest Size”. It took me a moment to figure out what these sizes mean. They are the length in bytes of the hex-encoded response field in the Authorization header. That’s surprising. I would prefer that digest size (if needed at all) be expressed in bits or bytes of the hash function result (so 256 or 32 for SHA-256) rather than nibbles.

Yoav

On Apr 10, 2014, at 2:42 AM, Rifaat Shekh-Yusef <[email-masked]> wrote:

> Hi,
> 
> This new version of the draft addresses all the comments received during the last IETF meeting and based on my response to the Minutes of the meeting.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 10 Apr 2014 07:44:56 -0400

Thanks Yoav,

I am fine with both comments. I will fix them in the next version of the
draft.

Regards,
 Rifaat

On Thu, Apr 10, 2014 at 12:33 AM, Yoav Nir <[email-masked]> wrote:

> Thanks, Rifaat
>
> Two comments:
>
> 1. Section 3.7 still lists algorithms in order of preference. While this
> refers only to algorithms specified in this specification, and not to any
> other algorithms someone might add, I'm not sure we really need this. How
> about this:
>
> OLD:
>
> 2. In section 6.1 you have the initial registry with a column for "Digest
> Size". It took me a moment to figure out what these sizes mean. They are
> the length in bytes of the hex-encoded response field in the Authorization
> header. That's surprising. I would prefer that digest size (if needed at
> all) be expressed in bits or bytes of the hash function result (so 256 or
> 32 for SHA-256) rather than nibbles.
>
> Yoav
>
>