Subject: [http-auth] I-D Action: draft-ietf-httpauth-scram-auth-12.txt

From: [email-masked]
Date: Sat, 28 Nov 2015 07:49:43 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : Salted Challenge Response (SCRAM) HTTP Authentication Mechanism
        Author          : Alexey Melnikov
	Filename        : draft-ietf-httpauth-scram-auth-12.txt
	Pages           : 19
	Date            : 2015-11-28

Abstract:
   The authentication mechanism most widely deployed and used by
   Internet application protocols is the transmission of clear-text
   passwords over a channel protected by Transport Layer Security (TLS).
   There are some significant security concerns with that mechanism,
   which could be addressed by the use of a challenge response
   authentication mechanism protected by TLS.  Unfortunately, the HTTP
   Digest challenge response mechanism presently on the standards track
   failed widespread deployment, and have had success only in limited
   use.

   This specification describes a family of HTTP authentication
   mechanisms called the Salted Challenge Response Authentication
   Mechanism (SCRAM), which addresses security concerns with HTTP Digest
   and meets the deployability requirements.  When used in combination
   with TLS or an equivalent security layer, a mechanism from this
   family could improve the status-quo for HTTP authentication.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-scram-auth-12

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sun, 29 Nov 2015 15:59:04 -0500

Hi Alexey,

Can you please address the following nits:
https://www.ietf.org/tools/idnits?url=https://www.ietf.org/archive/id/draft-ietf-httpauth-scram-auth-12.txt

Also, can you please change the Intended status to Experimental.

Thanks,
 Rifaat

On Sat, Nov 28, 2015 at 10:49 AM, <[email-masked]> wrote:

>  This draft is a work item of the Hypertext Transfer Protocol
> Authentication Working Group of the IETF.
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Tony Hansen <[email-masked]>
Date: Sun, 29 Nov 2015 17:53:33 -0500

> Also, can you please change the Intended status to Experimental.

-1. The intended track should be proposed standard.

    Tony Hansen

---

From: Yoav Nir <[email-masked]>
Date: Mon, 30 Nov 2015 01:26:46 +0200

> On 30 Nov 2015, at 12:53 AM, Tony Hansen <[email-masked]> wrote:
> 
>> y 

Hi, Tony

I’m afraid that’s against our charter ([1]).

To quote: "Each of these RFCs will be Informational or Experimental”. This working group is chartered to define experimental protocols, and that is one reason why we’re happy to proceed without any interest from browser makers or web servers. 

Yoav
[1] http://tools.ietf.org/wg/httpauth/charters

---

From: Tony Hansen <[email-masked]>
Date: Sun, 29 Nov 2015 18:39:27 -0500

On 11/29/15 6:26 PM, Yoav Nir wrote:
> To quote: "Each of these RFCs will be Informational or Experimental”. ...

Hmmph. Okay. :-)

Thanks for the course correction.

    Tony Hansen

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 29 Nov 2015 20:21:25 -0500

Sent from my iPhone

> On Nov 29, 2015, at 6:39 PM, Tony Hansen <[email-masked]> wrote:
> 

Yes, also since there were several competing proposals, this was agreed upon as the direction to move them all forward in the WG.

Thanks,
Kathleen