Subject: [drinks] Your DISCUSS on draft-ietf-drinks-spp-protocol-over-soap

From: Alexander Mayrhofer <[email-masked]>
Date: Mon, 23 Mar 2015 15:12:53 +0000

Hello Stephen,

You raised a DISCUSS around the use of Digest Authentication in the DRINKS SOAP transport
(https://datatracker.ietf.org/doc/draft-ietf-drinks-spp-protocol-over-soap/)

Specifically, you asked whether the WG considered client certificates as the authentication method. 
The WG had extensive "design team" discussions since 2009, and from what i remember (i couldn't find 
it in the minutes), the discussions about client certificates mostly based on experience with EPP (the 
Extensible Provisioning Protocol). EPP "sort of" requires client certificates (See Section 6 of RFC 5734), 
but in practical, almost none of the deployments of EPP in the field require a client to present a 
certificate. 

We wanted to avoid a similar situation with SPPP, and - with the practical experience from EPP - therefore
didn't want to require client certificate based authentication. Furthermore, we wanted to reduce the variety 
of authentication methods a client / server needs to implement to foster interopability (we were fearing a 
"mandatory to implement" style discussion, and hence agreed to used Digest only).

The text that is now in the document was based on feedback of the document's WGLC in 2012:
https://www.ietf.org/mail-archive/web/drinks/current/msg01233.html

If the explanation above  doesn't address your concerns, would adding text that allows "authentication methods with similar security properties" (I'm not sure whether that is too vague, and it also wouldn't address the concern of interopability) address that issue?

Also, i'm around in Dallas until Friday noon - so i'm more than happy to discuss this in person, if you have time? It would be great if we could resolve this over the next days, because we want to  finally get the documents "out of the door" so that Richard can shut down the WG :)

thanks,
Alex Mayrhofer