Subject: [http-state] SCS draft -01

From: tho <[email-masked]>
Date: Mon, 7 Mar 2011 08:47:51 +0100

Hello all,

we have just published an updated version of the SCS draft which can be found at:

  http://tools.ietf.org/html/draft-secure-cookie-session-protocol-01

The major difference as compared to -00 is that, due to changed cookie-value encoding between -22 and -23 of draft-ietf-httpstate-cookie, the five SCS cookies have now been condensed into one anonymous cookie-value.

Another significant delta from -00 is that the intro section has been rewritten to (hopefully) better describe the basic set of security services that SCS provides: cookie data confidentiality, cookie data integrity, and sender (i.e. origin) authentication.  The former reasoning has been somewhat reversed, and the "no-storage session" scenario is now given as a natural outspring of the aforementioned properties.

Last but not least, a bug in the authentication tag computation has been fixed (thanks David!).

Other minor improvements concern inbound and outbound algorithms layout and a new section describing SCS cookie "inflation".

The source code at http://github.com/koanlogic/libscs -- which has reached a fairly stable state -- fully implements the -01 spec.

Any comment is welcome.

t.