Subject: [http-auth] WGLC for draft-ietf-httpauth-digest-08

From: Alexey Melnikov <[email-masked]>
Date: Wed, 22 Oct 2014 14:34:36 +0100

Hi,
Some notes/comments from reviewing the document.

The definition of "stale" says:

       The server should only set stale to
       TRUE if it receives a request for which the nonce is invalid but
       with a valid digest for that nonce (indicating that the client
       knows the correct username/password).

I think this is encouraging DoS on servers. I think it would be better 
if the check for staleness is done without computing the hash on the 
server side.

       The notation unq(X) means the value of the quoted-string X without
       the surrounding quotes.

"Without the quotes" or "without the quotes and with quoting slashes 
removed"? I.e., what is used for a value "abc\"def"?

In 3.4.2 - is the definition of A1 for "MD5-sess" backward compatible 
with RFC 2617?

Nonce-prime/cnonce-prime - are these limited to the same TCP connection?

Should RFC 5198 (Net Unicode) be recommended for use on top of NFC? For 
example, it discourages use of Unicode Control characters.

Is it Ok to fail authentication if a username is not in NFC? If yes, it 
would be good to mention how the server should respond in such case.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 22 Oct 2014 18:23:44 +0300

Hi

The WGLC for draft-ietf-httpauth-digest is done.

Some comments have been made, and the discussion is still on-going. That’s OK, and please keep the discussion going. There is no deadline for the discussion at this time.

I would like to call the authors’ attention to another deadline. EOD Monday, 27-October is the Internet draft submission cutoff.  I would like to encourage the authors to submit a draft with all points that have been resolved in discussion at that time. There is no reason to stop the discussion, though, as draft submission will again be open two weeks later, on November 10th.

We have not yet finalized the agenda for the meeting. We will obviously spend time on the Basic draft, but if at that time there are still open issues for Digest, we will definitely spend as much time as needed on those.

Thanks

Matt & Yoav