Subject: Re: WG Review: Recharter of Hypertext Transfer Protocol Bis (httpbis)

From: Adrien de Croy <[email-masked]>
Date: Thu, 01 Mar 2012 09:09:56 +1300

There is one other thing I would add to auth:

Ability for a challenger to identify itself, and for a response to 
target a challenger.

Currently with chained proxies, it's not possible to reliably pass 
challenges and creds back to the client.  A proxy looking at a request 
would need to maintain state to know if it challenged the client or not.

Adding a parameter to the challenge and response which identifies the 
challenger would allow for this.

In fact it would then allow proxy and server auth to use the same 
mechanism and headers.

Adrien

On 1/03/2012 8:19 a.m., Henrik Nordström wrote:
> tis 2012-02-21 klockan 19:50 +0100 skrev Julian Reschke:
>> Well, we have an existing authentication framework. It would be
>> interesting to find out what's missing from it.
> My take is better secure authentication schemes (not plaintext password
> based) which is cleanly specified to a level that implementations
> actually interop properly, and the ability for site owners (and proxies)
> to influence how the login process is presented to users in a safe
> manner that do not collide with preceived https security or makes a mess
> for matchine<->machine communication not involving humans.
>
> The existing HTTP auth framework works in general very well for
> machine<->machine.
>
> This said I have used HTTP Digest authentication quite successfully (but
> with a number of interop workarounds) with non-tech users using the
> default login box, only providing a good error response message seen if
> the user cacels of fails the login.
>
> Regards
> Henrik
>
>

-- 
Adrien de Croy - WinGate Proxy Server - http://www.wingate.com

---

From: Henrik Nordström <[email-masked]>
Date: Wed, 29 Feb 2012 20:19:32 +0100

Regards
Henrik

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 10:50:33 -0700

<hat type='AD'/>

On 2/21/12 11:10 AM, IESG Secretary wrote:
> A modified charter has been submitted for the Hypertext Transfer 
> Protocol Bis (httpbis) working group in the Applications Area of the 
> IETF.  The IESG has not made any determination as yet.  The modified 
> charter is provided below for informational purposes only.  Please send 
> your comments to the IESG mailing list ([email-masked]) by Tuesday, 
> February 28, 2012.

Clearly this rechartering request has triggered a lengthy discussion
about web authentication. However, the only comment on the charter
itself Stephen Farrell's noting that this bullet is a bit vague
(specifically that it does not mention authentication):

> * Reflecting modern security requirements and practices

Stephen and I just had a chat about this matter. He and I came up with a
proposed paragraph to add after that list of bullet points:

   In the initial phase of work on HTTP/2.0, new proposals
   for authentication schemes can be made.  The WG will
   select zero or more of those with a goal of choosing
   at least one scheme that is better than those available
   for HTTP/1.x.  Non-selected schemes might be discussed
   with the IETF Security Area for further work there.

Your comments are welcome.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Tim Bray <[email-masked]>
Date: Thu, 1 Mar 2012 09:57:39 -0800

+1

On Thu, Mar 1, 2012 at 9:50 AM, Peter Saint-Andre <[email-masked]> wrote:
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: Nick Hilliard <[email-masked]>
Date: Thu, 01 Mar 2012 18:01:32 +0000

> Your comments are welcome.

Can I suggest you also include authorization capabilities as a core
component of this. It's not much use to have people able to authenticate
themselves to a system if that system doesn't also provide a framework for
allowing the server-side application decide what they can or cannot do.

Nick

---

From: SM <[email-masked]>
Date: Thu, 01 Mar 2012 10:05:19 -0800

>    with the IETF Security Area for further work there.

If the WG selects zero, how can it meet the goal of choosing at least 
one scheme?

Regards,
-sm

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 11:40:57 -0700

> If the WG selects zero, how can it meet the goal of choosing at least

One can have a goal of choosing a scheme that's better, but if no one
proposes any or none of the selected schemes are deemed better, then we
will not achieve the goal. Perhaps that thought could be worded more
clearly.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 11:43:47 -0700

[ no hat ]

> allowing the server-side application decide what they can or cannot do.

Feel free to include that in your proposal. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 1 Mar 2012 11:08:01 -0800

> allowing the server-side application decide what they can or cannot do.

This is a request for an HTTP capability that is significantly different than what has been proposed before, and has not been one of the items that caused problems in HTTP 1.x. I suggest that this not be part of the charter for httpbis until it can be shown to be a significant need, not just a new idea.

--Paul Hoffman

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 1 Mar 2012 11:09:15 -0800

On Mar 1, 2012, at 10:05 AM, SM wrote:

> If the WG selects zero, how can it meet the goal of choosing at least one scheme?

It doesn't, of course. If the WG doesn't meet that goal, it will be clear at the time, and the WG can ask to recharter for that limited purpose.

--Paul Hoffman

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 2 Mar 2012 09:09:20 +1100

WFM. Thanks, Peter.

--
Mark Nottingham   http://www.mnot.net/