Subject: Re: [Last-Call] Secdir last call review of draft-ietf-httpbis-bcp56bis-12

From: Mark Nottingham <[email-masked]>
Date: Tue, 3 Aug 2021 10:50:39 +1000

Hi Joe,

> On 3 Aug 2021, at 6:33 am, Joseph Salowey <[email-masked]> wrote:
> [Joe]  I think we should deprecate MD5 in all cases and I also think you should treat digest as basic auth and run it over a secure channel in all cases.  The text update looks good.  

There's been some... pushback on list since:
  https://www.w3.org/mid/[email-masked]

Would you be comfortable if we just removed the discussion of digest and MD5 completely, and deferred action to an (eventual) update of 7616?

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 Aug 2021 09:21:48 +1000

> On 4 Aug 2021, at 2:46 am, Joseph Salowey <[email-masked]> wrote:
> 
> [Joe]  The document is already down the path of adding normative language around 7616 by requiring a secure channel just when using digest MD5.   This guidance doesn't seem specific to the APIs case.  Why can't the document improve the normative guidance to update to MUST NOT use MD5 and MUST use a secure channel with digest?  

The proposal was to remove discussion of MD5 *and* digest, deferring to 7616 (and an eventual update).

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 Aug 2021 11:51:58 +1000

See:
  https://github.com/httpwg/http-extensions/commit/9f3c2faa3

This fits in with the overall approach of the document -- as a BCP, we're shying away from placing requirements on implementations. 

Cheers,

> On 4 Aug 2021, at 9:21 am, Mark Nottingham <[email-masked]> wrote:
> 
> 
>