Subject: [http-auth] AD review of draft-ietf-httpauth-digest

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 19 Mar 2015 10:41:34 -0400

Hello,

Thank you very much for your work on this draft!  It looks very good, so I
just have a few comments.

I don't see a list of changes from the draft this updates and that's pretty
typical and helps subsequent reviewers to understand what was changed.  Can
that be added?

Section 6.1
If this is creating the registry, shouldn't the references be filled in?
Right now, they each just say RFC XXXX.

Thanks!

-- 

Best regards,
Kathleen

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 19 Mar 2015 10:59:33 -0400

Hi Kathleen,

Thanks for you review and comments.

Appendix A covers the changes from RFC2617; is that what you are looking
for?
Regarding the registry, the RFC XXXX refers to this document, which does
not have an RFC number yet.

Regards,
 Rifaat

On Thu, Mar 19, 2015 at 10:41 AM, Kathleen Moriarty <
[email-masked]> wrote:

> I don't see a list of changes from the draft this updates and that's
> pretty typical and helps subsequent reviewers to understand what was
> changed.  Can that be added?
>
> Section 6.1
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 19 Mar 2015 12:17:24 -0400

Hello Rifaat,

Thanks for your quick response.  Inline.

Sent from my iPhone

> On Mar 19, 2015, at 10:59 AM, Rifaat Shekh-Yusef <[email-masked]> wrote:
> 
> Hi Kathleen,
> 
> Appendix A covers the changes from RFC2617; is that what you are looking for?

Yes, surprised I missed it.

> Regarding the registry, the RFC XXXX refers to this document, which does not have an RFC number yet.

Ok, for some reason, that wasn't clear to me.  When I looked at it, I assumed the reference would be to an RFC about the algorithm.  I think tweaking the sentence that says, "A reference to the specification that describes the algorithm." To something like "A reference to the specification adding the algorithm to this registry."

If the WG would like to kick off IETF last call, this tweak can happen with any others from last call.  If you want to wait until Monday, we can do that too.  Another option would be to wait until after the IETF.  Opinions on timing vary between WGs, so if the editors, shepherd, and chairs let me know their preference, we'll proceed.

Thanks,
Kathleen 

> 
> Regards,
>  Rifaat
> 
> 
> 
>> On Thu, Mar 19, 2015 at 10:41 AM, Kathleen Moriarty <[email-masked]> wrote:
>> Hello,
>> 
>> Thank you very much for your work on this draft!  It looks very good, so I just have a few comments.
>> 
>> I don't see a list of changes from the draft this updates and that's pretty typical and helps subsequent reviewers to understand what was changed.  Can that be added?
>> 
>> Section 6.1
>> If this is creating the registry, shouldn't the references be filled in?  Right now, they each just say RFC XXXX.
>> 
>> Thanks!
>> 
>> -- 
>> 
>> Best regards,
>> Kathleen
>>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 19 Mar 2015 18:25:19 +0200

I think we should start IETF LC now.

Yoav

> On Mar 19, 2015, at 6:17 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hello Rifaat,
> 
> On Mar 19, 2015, at 10:59 AM, Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> Hi Kathleen,
>> 
>> On Thu, Mar 19, 2015 at 10:41 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
>> Hello,
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/http-auth <https://www.ietf.org/mailman/listinfo/http-auth>
>> 
>>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 19 Mar 2015 12:59:32 -0400

Inline...

On Thu, Mar 19, 2015 at 12:17 PM, Kathleen Moriarty <
[email-masked]> wrote:

> Ok, for some reason, that wasn't clear to me.  When I looked at it, I
> assumed the reference would be to an RFC about the algorithm.  I think
> tweaking the sentence that says, "A reference to the specification that
> describes the algorithm." To something like "A reference to the
> specification adding the algorithm to this registry."
>
>
Sure, I am ok with this proposed change.

> If the WG would like to kick off IETF last call, this tweak can happen
> with any others from last call.  If you want to wait until Monday, we can
> do that too.  Another option would be to wait until after the IETF.
> Opinions on timing vary between WGs, so if the editors, shepherd, and
> chairs let me know their preference, we'll proceed.
>
>
I agree with Yoav; I think we should start IETF LC.

Regards,
 Rifaat

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 19 Mar 2015 14:08:03 -0400

Yoav,

The shepherd's report doesn't include information about implementations.
Are there implementations that have made the additions included in this
draft?

Thank you.

On Thu, Mar 19, 2015 at 12:59 PM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

>>> If this is creating the registry, shouldn't the references be filled
>>> in?  Right now, they each just say RFC XXXX.
>>>
>>> Thanks!
>>>
>>> --
>>>
>>> Best regards,
>>> Kathleen
>>>

-- 

Best regards,
Kathleen

---

From: Yoav Nir <[email-masked]>
Date: Thu, 19 Mar 2015 20:49:43 +0200

AFAICT, no. Rifaat?

> On Mar 19, 2015, at 8:08 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Yoav,
> 
> The shepherd's report doesn't include information about implementations.  Are there implementations that have made the additions included in this draft?
> 
> Thank you.
> 
> On Thu, Mar 19, 2015 at 12:59 PM, Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]>> wrote:
> Inline...
> 
> On Thu, Mar 19, 2015 at 12:17 PM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
> Hello Rifaat,
>

---

From: Sophie <[email-masked]>
Date: Thu, 19 Mar 2015 21:06:17 +0100

Hi!

yes, what information is required?

Best Regards,
Sophie

Am 19.03.2015 um 19:08 schrieb Kathleen Moriarty:

> On Thu, Mar 19, 2015 at 12:59 PM, Rifaat Shekh-Yusef <[email-masked]> wrote:
> Inline...
> 
> On Thu, Mar 19, 2015 at 12:17 PM, Kathleen Moriarty <[email-masked]> wrote:
> Hello Rifaat,
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 19 Mar 2015 22:15:02 +0200

Hi.

Are there implementations of the new stuff in the document:
Support for UTF-8 (I guess yes, because for Basic it turned out that all browsers were OK)
Support for the charset parameter
Support for userhash.

Yoav

> On Mar 19, 2015, at 10:06 PM, Sophie <[email-masked]> wrote:
> 
> Hi!
>

---

From: Sophie Bremer <[email-masked]>
Date: Thu, 19 Mar 2015 21:49:58 +0100

Inline

> Support for UTF-8 (I guess yes, because for Basic it turned out that all browsers were OK)

Yes.

> Support for the charset parameter

Yes.

> Support for userhash.

Yes.

Commercial implementations (app+server) support charset and userhash with UTF-8, but not plain UTF-8 usernames.
There is php code for the examples available: https://github.com/Netzkonform/HTTP-Digest/tree/master/tests/examples supporting every addition.
I work on commercial and open source implementations of the final specifications including support for plain UTF-8 usernames, but it is not released in the wild yet.

Regards,
Sophie

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 19 Mar 2015 16:53:27 -0400

Hi Sophie,

On Thu, Mar 19, 2015 at 4:49 PM, Sophie Bremer <[email-masked]

>    - Support for UTF-8 (I guess yes, because for Basic it turned out that
>    all browsers were OK)
>
>
> Yes.
>
>
>    - Support for the charset parameter
>
>
> Yes.
>
>
>    - Support for userhash.
>
>
> Yes.
>
> There is php code for the examples available:
> https://github.com/Netzkonform/HTTP-Digest/tree/master/tests/examples supporting
> every addition.
> I work on commercial and open source implementations of the final
> specifications including support for plain UTF-8 usernames, but it is not
> released in the wild yet.
>

Thanks for the information!  Is there more than one implementation?   This
will be of interest during IESG review.

-- 

Best regards,
Kathleen

---

From: Sophie Bremer <[email-masked]>
Date: Thu, 19 Mar 2015 22:17:16 +0100

Well, the commercial client part is ObjC and the server part is C#, the examples (client+server) are done in PHP.

If you ask for several implementers, I am not aware of others.
I was contacted by a server vendor last year, but they decided to wait for the final specifications.

Am 19.03.2015 um 21:53 schrieb Kathleen Moriarty:

> Hi Sophie,
> 
> On Thu, Mar 19, 2015 at 4:49 PM, Sophie Bremer <[email-masked]> wrote:
> Inline
> 
> Thanks for the information!  Is there more than one implementation?   This will be of interest during IESG review.
> 
> 
> 
> Regards,
> Sophie
> 
>> 
>> Yoav
>>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 19 Mar 2015 17:36:40 -0400

Thank you, Sophie.

Sent from my iPhone

> On Mar 19, 2015, at 5:17 PM, Sophie Bremer <[email-masked]> wrote:
>

---

From: Julian Reschke <[email-masked]>
Date: Fri, 20 Mar 2015 08:24:55 +0100

On 2015-03-19 21:15, Yoav Nir wrote:
>   * Support for UTF-8 (I guess yes, because for Basic it turned out that
>     all browsers were OK)
> ...

For Basic, browsers are ok with "charset" in that they currently ignore it.

Best regards, Julian