Subject: Re: [http-auth] (due Sep 20) Mutual-auth issues (part 2)

From: 大岩寛 <[email-masked]>
Date: Tue, 13 Oct 2015 09:29:20 +0000

Dear HTTPAUTH WG members,

We'll go forward with the current specification regarding the following issues.
Thank you.

-- 
Yutaka OIWA, Ph.D.       Leader, Cyber Physical Architecture Research Group
                                  Information Technology Research Institute
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

> -----Original Message-----
> From: Yutaka OIWA
> Sent: Wednesday, September 9, 2015 3:42 PM
> To: [email-masked]
> Subject: [http-auth] (due Sep 20) Mutual-auth issues (part 2)
> 
> Dear all HTTPAUTH WG members,
> 
> I'd like to have your comments on the following four issues.
> Please make your initial response *before September 20*, or the WG will consider
> these issues as successfully resolved (as the WG Chair said in the Prague
> meeting.)
> 
> We appreciate your responses in any of the following form:
>   * on the github issue tracking system (comments, pull-request etc.)
>   * on this mailing list
>   * on the private email
> We'll summarize comments on the medium above, and send it to this mailing list.
> (Please be understood that your comments on the private email may be included
> in the summary and published.)
> 
> 
> ==== draft-ietf-httpauth-mutual ====
> 
> = Section 4.1: 401-INIT =
> 
> [P4] The set of pwd-hash parameters for user-DB migrations:
>      none, md5, digest-md5, sha1 makes sense?
>   https://github.com/yoiwa/httpauth-mutual/issues/4
> 
> [P5] reason parameter:
>      Are the listed reasons good and complete?
>   https://github.com/yoiwa/httpauth-mutual/issues/5
> 
> = Section 4.3 401-KEX-S1 =
> 
> [P6] Minimum parameter ranges:
>   * 80+ bits for session id (sid)
>   * 128+ slots for active nonces: nc-max, nc-window
>   * 60+ seconds for session key retention
>   https://github.com/yoiwa/httpauth-mutual/issues/6
> 
> = Section 5: Authentication Realms =
> 
> [P7] Current choices for authentication scopes are single-port, single-host,
> and wildcard-domain.
> Are these choices complete?
>   https://github.com/yoiwa/httpauth-mutual/issues/7
> 
> 
> Thank you for your cooperation.
> 
> --
> Yutaka OIWA, Ph.D.               Cyber Physical Architecture Research Group
>                                   Information Technology Research Institute
>     National Institute of Advanced Industrial Science and Technology (AIST)
>                       Mail addresses: <[email-masked]>, <[email-masked]>
> OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]
> 
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth