Subject: [http-auth] I-D Action: draft-ietf-httpauth-mutual-03.txt

From: [email-masked]
Date: Mon, 18 Aug 2014 19:26:33 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : Mutual Authentication Protocol for HTTP
        Authors         : Yutaka Oiwa
                          Hajime Watanabe
                          Hiromitsu Takagi
                          Kaoru Maeda
                          Tatsuya Hayashi
                          Yuichi Ioku
	Filename        : draft-ietf-httpauth-mutual-03.txt
	Pages           : 52
	Date            : 2014-08-18

Abstract:
   This document specifies a mutual authentication method for the Hyper-
   text Transfer Protocol (HTTP).  This method provides a true mutual
   authentication between an HTTP client and an HTTP server using
   password-based authentication.  Unlike the Basic and Digest
   authentication methods, the Mutual authentication method specified in
   this document assures the user that the server truly knows the user's
   encrypted password.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-mutual-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 19 Aug 2014 13:36:11 +0900

Dear all,

I updated the mutual and mutual-algo drafts as well.

The mutual draft updates the single-port auth-realm syntax
to be exactly same as the Web-Origin syntax, closing ticket #4.

The algo draft reflects the discussion on this list for
security analysis around K_s1.
It also incorporates "figure-based" description of the exchanges,
addressing for ticket #9.

In addition, references to HTTPBIS drafts are happily
updated to the published RFC :-)

2014-08-19 11:26 GMT+09:00  <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]