Subject: [KEYPROV] Issue#13: Shall we explicitly document how to construct AuthenticationCode over HTTP case?

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 08 Jun 2007 19:00:30 +0200

For issue#13: http://www.tschofenig.priv.at:8080/keyprov/issue13 Ming wrote: 

To securely send an authentication code over HTTP channel, we considered the 
following schemes:

An authentication code sent to a user consists actually two parts: the ID part 
and the secret part:

AuthenticationCode = ID | PASSCODE

When the authentication credential is sent over HTTP, the client can send 
the "digest" value of the portion PASSCODE along with clear ID portion. For 
example,

AuthenticationData = ID | Digest

where

Digest = CT-KIP-PRF-AES (K_AUTH (PASSCODE),  ID || serverURL [|| ServerNonce], 
16)

Shall we dedicate a section in the spec to describe such recommendation? I 
prefer to do so.

Thoughts?

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov