Subject: [http-auth] [IANA #814285] Last Call: <draft-ietf-httpauth-digest-15.txt> (HTTP Digest Access Authentication) to Proposed Standard

From: "Amanda Baber via RT" <[email-masked]>
Date: Wed, 01 Apr 2015 18:45:21 +0000

(BEGIN IANA LAST CALL COMMENTS)

IESG/Authors/WG Chairs:

IANA has reviewed draft-ietf-httpauth-digest-15.  Please see the review below and report any inaccuracies as soon as possible.

IANA's reviewer has a question about the action requested in the IANA Considerations section of this document.

QUESTION: Where should the new registry be located? Should it be created at a new URL? If so, should it be listed under an existing category at http://www.iana.org/protocols, or a new one?  If the latter, what should be the name of the category? Should the webpage have the same title? (This is typically, but not always, the case.)

IANA understands that, upon approval of this document, there are two actions which IANA must complete.

First, IANA will create the HTTP Digest Hash Algorithms registry at a location to be determined (see above). The registry will be maintained via the Specification Required policy defined in RFC 5226.

Initial registrations:

+----------------+-------------+----------------+
| Hash Algorithm | Digest Size | Reference |
+----------------+-------------+----------------+
| MD5 | 128 | [ RFC-to-be ] |
| SHA-512-256 | 256 | [ RFC-to-be ] |
| SHA-256 | 256 | [ RFC-to-be ] |
+----------------+-------------+----------------+

Second, in the HTTP Authentication Schemes registry at

https://www.iana.org/assignments/http-authschemes/

a new scheme will be registered as follows:

Authentication Scheme Name: Digest
Reference: [ RFC-to-be ]
Notes: 

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed.  

Thanks,

Amanda Baber
IANA Request Specialist
ICANN

(END IANA LAST CALL COMMENTS)

On Thu Mar 19 20:15:43 2015, [email-masked] wrote:
> 
> The IESG has received a request from the Hypertext Transfer Protocol
> Authentication WG (httpauth) to consider the following document:
> - 'HTTP Digest Access Authentication'
>   <draft-ietf-httpauth-digest-15.txt> as Proposed Standard
> 
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2015-04-02. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>    HTTP provides a simple challenge-response authentication mechanism
>    that may be used by a server to challenge a client request and by a
>    client to provide authentication information.  This document defines
>    the HTTP Digest Authentication scheme that can be used with the HTTP
>    authentication mechanism.
> 
> Editorial Note (To be removed by RFC Editor before publication)
> 
>    Discussion of this draft takes place on the HTTPAuth working group
>    mailing list ([email-masked]), which is archived at [1].
> 
> 
> 
> 
> The file can be obtained via
> http://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/
> 
> IESG discussion can be tracked via
> http://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/ballot/
> 
> 
> No IPR declarations have been submitted directly on this I-D.
> 
>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 1 Apr 2015 15:46:49 -0400

Please, see inline for my opinion on what should be done with the registry,
but I would like to hear what others, with more experience with this, have
to say about it.

On Wed, Apr 1, 2015 at 2:45 PM, Amanda Baber via RT <
[email-masked]> wrote:

> IANA has reviewed draft-ietf-httpauth-digest-15.  Please see the review
> below and report any inaccuracies as soon as possible.
>
> QUESTION: Where should the new registry be located? Should it be created
> at a new URL?

I think new URL is needed.

> If so, should it be listed under an existing category at
> http://www.iana.org/protocols, or a new one?

I think new category is needed; I could not find a category close enough to
cover what we want with this registry.

> If the latter, what should be the name of the category?

"HTTP Digest Hash Algorithms"

> Should the webpage have the same title? (This is typically, but not
> always, the case.)
>
>
Yes.

> First, IANA will create the HTTP Digest Hash Algorithms registry at a
> location to be determined (see above). The registry will be maintained via
> the Specification Required policy defined in RFC 5226.
>
> Initial registrations:
>
There is already an existing entry for Digest, so I think the action here
is just to point to the new RFC-to-be.

Regards,
 Rifaat

> Note:  The actions requested in this document will not be completed until
> the document has been approved for publication as an RFC. This message is
> only to confirm what actions will be performed.
>
> Thanks,
>
> Amanda Baber
> IANA Request Specialist
> ICANN
>

---

From: Barry Leiba <[email-masked]>
Date: Wed, 1 Apr 2015 15:57:55 -0400

> "HTTP Digest Hash Algorithms"

I'm confused.  Can you tell me why the "Hypertext Transfer Protocol
(HTTP) Digest Algorithm Values" category isn't "close enough to cover"
this?  And how does this registry fundamentally differ from the
registry that's already there, "HTTP Digest Algorithm Values"?

Barry

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 1 Apr 2015 16:07:58 -0400

Hi Barry,

Thanks for your response.
I see two differences: the purpose is different (as defined in rfc3230),
and the output is defined as base64.

Regards,
 Rifaat

---

From: Barry Leiba <[email-masked]>
Date: Wed, 1 Apr 2015 16:12:36 -0400

> I see two differences: the purpose is different (as defined in rfc3230), and
> the output is defined as base64.

That's a reason that you can't put this registry on the same page as
the other, when they're both intended for HTTP Digest?

b

---

From: Barry Leiba <[email-masked]>
Date: Wed, 1 Apr 2015 16:53:34 -0400

> I do not know; that is the reason I mentioned that I would like to hear the
> opinion of people that have a better understanding of the registry.
> I have no problem with using the same registry if that is possible and does
> not cause any confusion.
>
> So, can you please explain how should we go about doing that?

Not the same registry.  The same category.

How you go about doing that is by changing your answers to Pearl's

> I think new URL is needed.

It can go as a second registry on this URL:
   http://www.iana.org/assignments/http-dig-alg/

> cover what we want with this registry.

It will go fine as a second registry in the existing category
"Hypertext Transfer Protocol (HTTP) Digest Algorithm Values".

--
Now, the problem is that this registry is *so* similar to the existing
"HTTP Digest Algorithm Values" registry that people will be confused.
That's one reason I want to put them on the same page -- so it's
easier to make the differences obvious.

First, the existing registry is poorly named, especially considering
that HTTP digest authentication existed when that registry -- which
has to do with creating a hash digest of the content, not with
authentication -- was created.  We can't fix that now, but we can add
an explanation of its purpose to the registry in order to clarify
things for people who are poking around.

And we can also change the name of your registry to make things
clearer as well.  So, I suggest the following, in addition to putting
them in the same category and on the same web page:

1. Change the name of your registry to "Hash Algorithms for HTTP
Digest Authentication", to make it clear that this has to do with HTTP
Digest Authentication.  The order of the words is important, to make
sure it's clear that "Authentication" is tightly bound to "HTTP
Digest" here.

2. Add a brief description to the new registry's header that says that
this registry lists the hash algorithms that can be used in HTTP
Digest Authentication.

3. Add a brief description to the existing "HTTP Digest Algorithm
Values" registry that says that this registry lists the algorithms
that can be used when creating digests of an HTTP message body, as
specified in RFC 3230.

I think that will adequately distinguish these two registries, and
avoid confusion between them.

What do you think?

Barry

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 1 Apr 2015 16:16:23 -0400

Regards,
 Rifaat

On Wed, Apr 1, 2015 at 4:12 PM, Barry Leiba <[email-masked]> wrote:

> >> > I think new category is needed; I could not find a category close
> enough
> >> > to

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 1 Apr 2015 17:20:11 -0400

> Not the same registry.  The same category.

Ah, that makes more sense now.

> "Hypertext Transfer Protocol (HTTP) Digest Algorithm Values".

Sounds reasonable to me.

I appreciate your help with this, Barry!

Regards,
 Rifaat

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 3 Apr 2015 07:06:42 -0400

Pearl,

Does this address all of your questions?

Thanks,
 Rifaat

On Wed, Apr 1, 2015 at 5:20 PM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

>> enough to

---

From: "Pearl Liang via RT" <[email-masked]>
Date: Fri, 03 Apr 2015 16:39:33 +0000

Rifaat,

> Does this address all of your questions?

Are you planning to submit a new version to include Barry's suggested revisions?

I however have a new question.  If it has been addressed, apologies in advance.
It is about section 6.2 for the Digest scheme.  Are you intended to replace 
the existing reference 'RFC2617 section 3' with this draft for the existing entry
'Digest'?  If so, the current text in section 6.2 is unclear or inaccurate:

/snip/
6.2.  Digest Scheme Registration

   This specification registers the Digest scheme with the
   Authentication Scheme Registry.

/snip/

Thanks,
~pl

Pearl Liang
ICANN

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 3 Apr 2015 14:51:01 -0400

Hi Pearl,

I have just submitted a new version, v16, that addresses both kathleen's
comment and Barry's suggestions.
I also adjusted the text in section 6.2 to indicate that we should only
update the registry.

Please, let me know if you have any further comments.

Regards,
 Rifaat

On Fri, Apr 3, 2015 at 12:39 PM, Pearl Liang via RT <
[email-masked]> wrote:

> > >> > I do not know; that is the reason I mentioned that I would like to
> hear
> > >> the
> > >> > I have no problem with using the same registry if that is possible
> and
> > >> does
> > >> > not cause any confusion.
> > >> >

---

From: "Pearl Liang via RT" <[email-masked]>
Date: Fri, 03 Apr 2015 20:31:07 +0000

Hi Rifaat, and Barry:

Barry, we have a question for you. 

Thank you for the prompt reply.  Section 6.2 in version -16 looks good.
We understood that the new created registry will be added to the registry 
"HTTP Digest Algorithm Values". 

Barry, can you please confirm if the following text will be needed to document
in the IC section of this draft?

- Add a brief description to the existing "HTTP Digest Algorithm
Values" registry (http://www.iana.org/assignments/http-dig-alg):

Note: This registry lists the algorithms that can be used when creating digests 
of an HTTP message body, as specified in RFC 3230.

Other than, we do not have further questions.

Thanks,
~pl

On Fri Apr 03 18:51:24 2015, [email-masked] wrote:
> > I however have a new question.  If it has been addressed, apologies
> > in
> > advance.
> > > > On Wed, Apr 1, 2015 at 4:53 PM, Barry Leiba
> > > > <[email-masked]>
> > > > wrote:
> > > >
> > > >> >> QUESTION: Where should the new registry be located? Should it
> > > >> >> be
> > > >> created
> > > >> >> at a new URL?
> > > >> >

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 3 Apr 2015 17:56:28 -0400

Hi Pearl,

That comment should go into the existing "HTTP Digest Algorithm Values"
registry, as it does not apply to the new "Hash Algorithms for HTTP Digest
Authentication" registry.
So the comment you quoted cannot go into this document.

Regards,
 Rifaat

On Fri, Apr 3, 2015 at 4:31 PM, Pearl Liang via RT <[email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 3 Apr 2015 18:37:48 -0400

> I also adjusted the text in section 6.2 to indicate that we should only

Thank you for adding in my comments and Barry for the helpful advice to
distinguish the 2 registries.

-- 

Best regards,
Kathleen

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 6 Apr 2015 08:33:46 -0400

Hi Pearl,

Did we address all you questions with the last email below?

Regards,
 Rifaat

On Fri, Apr 3, 2015 at 5:56 PM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

> On Fri, Apr 3, 2015 at 4:31 PM, Pearl Liang via RT <

---

From: Barry Leiba <[email-masked]>
Date: Mon, 6 Apr 2015 08:44:07 -0400

> Did we address all you questions with the last email below?

Actually, I meant to reply to this, but seder stuff got in the way.  Sorry...

>> So the comment you quoted cannot go into this document.

I think it's perfectly reasonable for you to put the update to the
existing registry into this document, in the IANA Considerations
section.  Something like this:

NEW
To clarify the purpose of the existing registry and to avoid confusion
between the two registries, IANA is asked to add the following
description to the existing "HTTP Digest Algorithm Values" registry:

   This registry lists the algorithms that can be used when creating
   digests of an HTTP message body, as specified in RFC 3230.

END

I think you can do that without including a reference to RFC 3230 in
your document, because you're just providing text for IANA, and not
actually making any real reference (and if anyone questions that, I'll
be happy to discuss it with them).

Barry

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 6 Apr 2015 08:57:54 -0400

Hmmm, this seems odd to me,but I have no problem of doing that.

Kathleen,

Are you ok with this?

Rgards,
 Rifaat

---

From: Barry Leiba <[email-masked]>
Date: Mon, 6 Apr 2015 09:02:57 -0400

> Hmmm, this seems odd to me,but I have no problem of doing that.

Clarifying the reason: IANA likes to have the changes they're asked to
make recorded (documented) somewhere, and I think it's better to have
it in the draft than to just have it in this email thread.

That said, I'm fine with however IANA agrees to do it.

b

---

From: "Pearl Liang via RT" <[email-masked]>
Date: Tue, 07 Apr 2015 03:21:34 +0000

Hi all,

I think Barry's suggested text for the registry is very useful.  It gives guidelines
to future users (and authors).  As Barry mentioned, we need to be able to point 
people to a source of the text.  If this draft is indeed not an appropriate place, 
I think we just need an "Okay" from ADs before we can add the Note in the registry.  
Barry, does this sound right?    

Thanks
~pl

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 7 Apr 2015 08:22:41 -0400

I do not have a strong opinion about this, so I can go either way.
If I do not hear any objection from the ADs today, I will spin another
version with the proposed change from Barry.

Regards,
 Rifaat

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 7 Apr 2015 19:32:17 -0400

Hi Pearl,

Please, take a look at v17 and let me know if that addresses all your
concerns.

Regards,
 Rifaat

---

From: "Pearl Liang via RT" <[email-masked]>
Date: Wed, 08 Apr 2015 15:57:49 +0000

Hi Rifaat,

Thank you.  This version looks okay.  Barry, please chime if we missed anything
else.

Regards,
~pl

---

From: Barry Leiba <[email-masked]>
Date: Wed, 8 Apr 2015 14:17:01 -0400

> Thank you.  This version looks okay.  Barry, please chime if we missed anything

It looks good to me.  Thanks, Rifaat.

Barry

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 8 Apr 2015 14:18:46 -0400

Thanks for your help with this, Barry. Much appreciated.

Regards,
 Rifaat