Subject: [http-auth] (due Sep 20) Mutual-auth issues (part 2)

From: Yutaka OIWA <[email-masked]>
Date: Wed, 9 Sep 2015 06:41:33 +0000

Dear all HTTPAUTH WG members,

I'd like to have your comments on the following four issues.
Please make your initial response *before September 20*,
or the WG will consider these issues as successfully resolved
(as the WG Chair said in the Prague meeting.)

We appreciate your responses in any of the following form:
  * on the github issue tracking system (comments, pull-request etc.)
  * on this mailing list
  * on the private email
We'll summarize comments on the medium above, and send it to this mailing list.  (Please be understood that your comments on the private email may be included in the summary and published.)

==== draft-ietf-httpauth-mutual ====

= Section 4.1: 401-INIT =

[P4] The set of pwd-hash parameters for user-DB migrations:
     none, md5, digest-md5, sha1 makes sense?
  https://github.com/yoiwa/httpauth-mutual/issues/4

[P5] reason parameter:
     Are the listed reasons good and complete?
  https://github.com/yoiwa/httpauth-mutual/issues/5

= Section 4.3 401-KEX-S1 =

[P6] Minimum parameter ranges:
  * 80+ bits for session id (sid)
  * 128+ slots for active nonces: nc-max, nc-window
  * 60+ seconds for session key retention
  https://github.com/yoiwa/httpauth-mutual/issues/6

= Section 5: Authentication Realms =

[P7] Current choices for authentication scopes are
single-port, single-host, and wildcard-domain.
Are these choices complete?
  https://github.com/yoiwa/httpauth-mutual/issues/7

Thank you for your cooperation.

-- 
Yutaka OIWA, Ph.D.               Cyber Physical Architecture Research Group
                                  Information Technology Research Institute
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]