Subject: [http-auth] Stephen Farrell's Yes on draft-ietf-httpauth-digest-18: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Tue, 21 Apr 2015 09:58:02 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-httpauth-digest-18: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I'm a yes on this, not because it's great
technology (it just isn't;-), but because it is a
valiant effort to do responsible updates to a
scheme that is used somewhat. Thanks for doing
the work.

- The intro could usefully say that this extends
but is generally backwards compatible with 2617
if you don't use any new stuff and include a
pointer to appendix A as well.

- p5, "nonce": "data string" is an odd
combination

- p6, "stale": Is "TRUE" the literal value? What
if it's "1" or "y" - just wondering in case
current code does something there. Section 3.3
(and elsewhere) uses "true" and "false" which
aren't the same as TRUE and FALSE (or are they?)
It'd be good to be consistent or to say that
we're not being consistent, presumably for
historical reasons.

- end of 3.4: is there a specific section of 7234
that's most relevant? If so, good to say so.

- 5.3, you could maybe add a reference to RFC7486
at the end of the 1st para (that is blatent
self-advertisement, but I couldn't resist:-)

- 5.6, is the "note" about Basic still true? I
thought Julian or someone tested it and found it
not quite so bad?

- I think something went wrong with the secdir
review [1] but I'd also encourage us to try to
bottom out on Hilarie's comments. There may be
something there that could be used, without any
damage to backwards compatibility, which would be
interesting.

   [1] https://www.ietf.org/mail-archive/web/secdir/current/msg05621.html

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 22 Apr 2015 17:08:50 -0400

Hi Stephen,

Thanks for your review and comments.
Please, see my reply inline...

Regards,
 Rifaat

On Tue, Apr 21, 2015 at 12:58 PM, Stephen Farrell <[email-masked]
> wrote:

> http://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

Ok

> - p5, "nonce": "data string" is an odd
I will change it to "string"

> we're not being consistent, presumably for
I will change it to "true" and "false".

> that's most relevant? If so, good to say so.
Will look into that.

> self-advertisement, but I couldn't resist:-)
Sure.

> thought Julian or someone tested it and found it
You are right; I will remove that note.

> damage to backwards compatibility, which would be
I did reply to that review. Do you have something specific that you think
we should address? it is the HMAC comment?

Regards,
 Rifaat

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 22 Apr 2015 22:17:02 +0100

On 22/04/15 22:08, Rifaat Shekh-Yusef wrote:
>> >
>> >
> I did reply to that review. 

You did.

> Do you have something specific that you think

I guess we ought just check again. It looked like the
reviewer didn't get the backwards compatibility constraints
under which this work is being done, but I wasn't entirely
clear whether or not the suggested improvements would or
would not break those constraints. It'd be good to check.

Cheers,
S.

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 24 Apr 2015 16:28:42 -0400

Hi,

It appears all of Stephen's comments have been addressed int he correct
revision (as well as all of the AD comments).  I see that Rifaat responded
to Hilary, but there was no follow up (that I can find).  Was there a
result from the HMAC comment in her review?

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 24 Apr 2015 16:56:11 -0400

HMAC was mentioned by both Francis (Gen-ART review) and Hilarie (SecDir
review).
As I mentioned before if it is ok with the ADs and the WG, I would be happy
to start a discussion and put a proposal to address that.
Is that acceptable at this stage? or maybe we should try to address HMAC
and Salted hash (request from STUNbis team) in a separate document?

Regards,
 Rifaat

On Fri, Apr 24, 2015 at 4:28 PM, Kathleen Moriarty <
[email-masked]> wrote:

> On Wed, Apr 22, 2015 at 5:17 PM, Stephen Farrell <
> [email-masked]> wrote:
>
>>
>>

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 24 Apr 2015 22:10:00 +0100

> and Salted hash (request from STUNbis team) in a separate document?

I think a separate document may be correct, if there's a liklihood
that it'd be implemented in browsers or some other HTTP clients and
servers and if the httpauth WG wanted to process that. If any of the
above are negative, then I suspect it's probably better to consider
this idea as a reasonable road-not-followed.

S.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 24 Apr 2015 17:17:33 -0400

Ok. Let's then let this draft progress and I will start a separate
discussion about HMAC & Salted hash.

Regards,
 Rifaat

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 24 Apr 2015 18:02:42 -0400

Excellent, thank you.

On Fri, Apr 24, 2015 at 5:17 PM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

> On Fri, Apr 24, 2015 at 5:10 PM, Stephen Farrell <

-- 

Best regards,
Kathleen