Subject: [http-auth] Fwd: New Version Notification for draft-reschke-httpauth-auth-info-00.txt

From: Julian Reschke <[email-masked]>
Date: Sat, 24 Jan 2015 20:10:05 +0100

Hi there,

as discussed before, I believe Authentication-Info (and 
Proxy-Authentication-Info) should be defined separately from Digest.

Here's my proposal.

Best regards, Julian

-------- Forwarded Message --------
Subject: New Version Notification for 
draft-reschke-httpauth-auth-info-00.txt
Date: Sat, 24 Jan 2015 11:01:27 -0800
From: [email-masked]
To: Julian F. Reschke <[email-masked]>, Julian F. Reschke 
<[email-masked]>

A new version of I-D, draft-reschke-httpauth-auth-info-00.txt
has been successfully submitted by Julian F. Reschke and posted to the
IETF repository.

Name:		draft-reschke-httpauth-auth-info
Revision:	00
Title:		The Hypertext Transfer Protocol (HTTP) Authentication-Info 
Header Field
Document date:	2015-01-24
Group:		Individual Submission
Pages:		5
URL: 
http://www.ietf.org/internet-drafts/draft-reschke-httpauth-auth-info-00.txt
Status: 
https://datatracker.ietf.org/doc/draft-reschke-httpauth-auth-info/
Htmlized: 
http://tools.ietf.org/html/draft-reschke-httpauth-auth-info-00

Abstract:
    This specification defines the "Authentication-Info" and "Proxy-
    Authentication-Info" header fields for use in HTTP authentication
    schemes which need to return additional information during or after
    authentication.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 26 Jan 2015 14:14:14 -0500 (EST)

> Proxy-Authentication-Info) should be defined separately from Digest.

% Authentication scheme definitions need to allow both notations, both
% for senders and recipients.  This allows recipients to use generic
% parsing components, independent of the authentication scheme in use.

Seems like cause for some 2119 language?

I think the security considerations section could explicitly mention that
using TLS (i.e., HTTPS)  reduces the leakage via HTTP header fields.

It seems likely that this document could be moved forward quickly.

-Ben

---

From: Julian Reschke <[email-masked]>
Date: Mon, 26 Jan 2015 21:03:37 +0100

> Seems like cause for some 2119 language?

Right now I don't have any 2119 keywords, and I wanted to see whether I 
can get away with that :-) What do others think?

> using TLS (i.e., HTTPS)  reduces the leakage via HTTP header fields.

Right. Will do.

Best regards, Julian

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 26 Jan 2015 12:13:55 -0800

On Jan 26, 2015, at 12:03 PM, Julian Reschke <[email-masked]> wrote:
> Right now I don't have any 2119 keywords, and I wanted to see whether I can get away with that :-) What do others think?

No need for 2119 language when saying "a different spec needs to do X". 2119isms in that situation are silly.

--Paul Hoffman