Subject: Re: [http-auth] Modifications to Basic & Digest

From: Yoav Nir <[email-masked]>
Date: Thu, 14 Aug 2014 07:48:15 +0300

Hi folks

Based on both the responses to this thread and previous threads about specific enhancements, I think we can call this.

There were no posts saying that we absolutely should not make any changes to Basic and Digest. There were some people who said these changes were worthwhile, and others who thought it didn’t add much. There were none in the “this makes things worse” camp.

So I think we can call consensus on allowing changes (in general).

About the two proposals for changes:

1. Add username hashing to Digest: there are more people who want this than there are people who care enough to say that they don’t care. There is also some implementation and deployment experience. And it also serves a privacy purpose by reducing the amount of personal information sent over the wire. So I think we can call this as accepted by the group. Since this modification is already in the draft, there are no action items here for Rifaat, David, and Sophie.

2. Adding username suggestion by the server to Basic. So far I only see one person advocating it. Anyone else?

If people in the group think I’m misreading this, please let us know on-list soon.

Thanks

Yoav

On Jul 24, 2014, at 6:24 PM, Yoav Nir <[email-masked]> wrote:

> Hi
> 
> A question we raised at the HTTP-Auth meeting today was whether or not we’d like to make any changes to Basic and Digest.
> 
> The charter requires us to add to things to these protocols:
> Adding internationalization support for user names and passwords
> Adding modern hash functions to Digest so that an implementation does not depend on MD5.
> 
> There are a few additional extensions proposed. The Digest draft includes optional username hashing, which (when used) will prevent the cleartext username from being sent on the wire. This sounds (to me) to be a good idea privacy-wise, but there is a claim that Basic and Digest are so horribly broken anyway, that we don’t want to add security features to them, even if said security features seem like a good idea (hence the “lipstick on a pig” comment I made at the session [1]).
> 
> So the question I’m asking the group here is, do we want to tinker with Basic and Digest, potentially making them somewhat better, or do we want to clamp down on all such discussion, and stick only to the mandates in the charter?
> 
> Yoav
> 
> [1]

---

From: Mike Sweet <[email-masked]>
Date: Thu, 14 Aug 2014 06:37:51 -0400

If we don't add the username parameter to Basic, then I'd just like to ask that the current draft be updated to allow additional parameters to be passed (right now it forbids them which closes the door to any extensions...)

Sent from my iPhone

> On Aug 14, 2014, at 12:48 AM, Yoav Nir <[email-masked]> wrote:
> 
> Hi folks
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Julian Reschke <[email-masked]>
Date: Fri, 15 Aug 2014 01:19:00 +0200

On 2014-08-14 12:37, Mike Sweet wrote:
> If we don't add the username parameter to Basic, then I'd just like to
> ask that the current draft be updated to allow additional parameters to
> be passed (right now it forbids them which closes the door to any
> extensions...)

It doesn't forbid them. It says they are to be ignored, and that you 
need to revise the spec to add new.

Best regards, Julian

---

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Fri, 15 Aug 2014 05:24:41 +0000

+1 for #2.

Smith

/**
    Smith Kennedy
    ATB Wireless Architect - PPS
    Hewlett-Packard Co.
*/

---

From: Julian Reschke <[email-masked]>
Date: Fri, 15 Aug 2014 20:35:24 +0200

As author of the Basic spec, I'm *very* -1 on adding anything new that 
is not essential.

We can discuss an IANA registry for parameters, but adding something 
experimental at this point doesn't make any sense to me.

Best regards, Julian

On 2014-08-15 07:24, Kennedy, Smith (Wireless Architect) wrote:
> On 2014-08-13, at 10:48 PM, Yoav Nir <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>> Hi folks
>>
>> Based on both the responses to this thread and previous threads about
>> specific enhancements, I think we can call this.
>>
>> There were no posts saying that we absolutely should not make any
>> changes to Basic and Digest. There were some people who said these
>> changes were worthwhile, and others who thought it didn’t add much.
>> There were none in the “this makes things worse” camp.
>>
>> 1. Add username hashing to Digest: there are more people who want this
>> than there are people who care enough to say that they don’t care.
>> There is also some implementation and deployment experience. And it
>> also serves a privacy purpose by reducing the amount of personal
>> information sent over the wire. So I think we can call this as
>> accepted by the group. Since this modification is already in the
>> draft, there are no action items here for Rifaat, David, and Sophie.
>>
>> 2. Adding username suggestion by the server to Basic. So far I only
>> see one person advocating it. Anyone else?
>>
>> On Jul 24, 2014, at 6:24 PM, Yoav Nir <[email-masked]
>> <mailto:[email-masked]>> wrote:
>>
>>> Hi
>>>
>>> A question we raised at the HTTP-Auth meeting today was whether or
>>> not we’d like to make any changes to Basic and Digest.
>>>
>>>  1. Adding internationalization support for user names and passwords
>>>  2. Adding modern hash functions to Digest so that an implementation
>>>     does not depend on MD5.
>>>
>>>
>>> There are a few additional extensions proposed. The Digest draft
>>> includes optional username hashing, which (when used) will prevent
>>> the cleartext username from being sent on the wire. This sounds (to
>>> me) to be a good idea privacy-wise, but there is a claim that Basic
>>> and Digest are so horribly broken anyway, that we don’t want to add
>>> security features to them, even if said security features seem like a
>>> good idea (hence the “lipstick on a pig” comment I made at the
>>> session [1]).
>>>
>>> So the question I’m asking the group here is, do we want to tinker
>>> with Basic and Digest, potentially making them somewhat better, or do
>>> we want to clamp down on all such discussion, and stick only to the
>>> mandates in the charter?
>>>
>>> Yoav
>>>
>>> [1]
>>
>> [email-masked] <mailto:[email-masked]>

---

From: Michael Sweet <[email-masked]>
Date: Fri, 15 Aug 2014 14:59:47 -0400

Julian,

An IANA registry for parameters would work.  Needing a spec/RFC for it can be problematic (since publishing through the IETF is not a fast process and far from a sure thing, even for an informational document), but if we can register a parameter then at least people know about it.

On Aug 15, 2014, at 2:35 PM, Julian Reschke <[email-masked]> wrote:

> As author of the Basic spec, I'm *very* -1 on adding anything new that is not essential.
> 
> We can discuss an IANA registry for parameters, but adding something experimental at this point doesn't make any sense to me.
> 
> Best regards, Julian
> 
> 

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

---

From: Yoav Nir <[email-masked]>
Date: Fri, 15 Aug 2014 22:14:40 +0300

As a matter of process, an IANA registry does not necessarily imply needing an RFC.

“First come first serve” and “expert review” are valid IANA registry policies.

Yoav

---

From: Michael Sweet <[email-masked]>
Date: Fri, 15 Aug 2014 16:17:19 -0400

Right, but the current text specifies that a new spec needs to be written.  I am totally OK with a registry and expert review (that's what we use for IPP...)