From bkihara.l@gmail.com Mon May 9 23:48:22 2011 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36915E0791 for ; Mon, 9 May 2011 23:48:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.49 X-Spam-Level: X-Spam-Status: No, score=-2.49 tagged_above=-999 required=5 tests=[AWL=1.110, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWTDb7j5piBQ for ; Mon, 9 May 2011 23:48:21 -0700 (PDT) Received: from mail-pw0-f44.google.com (mail-pw0-f44.google.com [209.85.160.44]) by ietfa.amsl.com (Postfix) with ESMTP id 8F0E2E0686 for ; Mon, 9 May 2011 23:48:21 -0700 (PDT) Received: by pwi5 with SMTP id 5so3640971pwi.31 for ; Mon, 09 May 2011 23:48:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=b0aESN3r1UrQL3AZIoy+uGckcUCi6OUez5hM48GxvVM=; b=D11HHh+D1GmUjf7EwEdoxANRlKhYIila4reXsBBht+FzUKOrLf5nDRSfIK8SRPk/7B 4bMdW55WZAXtjzmpU3a8yzocYzk7ltGgOlFHlkX7CJW7PVDN2uqTguEwGOLKGpmlrNQv RdoIvGS5/yCF7J9mhaTYtQzEM175HoXdCnTik= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=e5c2/hdzI3ABn1LNsTISepH2xzZWWEIOrEzMoQYfUlYUdEqphwkLm8vbcNC0t5Bsf+ ATwdpIt+tzuAlPFqep2DXoPRA9j++chhJ13wCNl2nAhmOv0aiZTw7vMGug1/fF67q7Cj yZUpEyM9Zds+SacSM6Eee6edpN0Cm8z60y8l0= MIME-Version: 1.0 Received: by 10.142.249.9 with SMTP id w9mr4423342wfh.2.1305010101168; Mon, 09 May 2011 23:48:21 -0700 (PDT) Received: by 10.142.161.18 with HTTP; Mon, 9 May 2011 23:48:21 -0700 (PDT) In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET> References: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET> Date: Tue, 10 May 2011 15:48:21 +0900 Message-ID: From: "KIHARA, Boku" To: http-auth@ietf.org Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Subject: [http-auth] Fwd: [apps-discuss] HTTP MAC Authentication Scheme X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 May 2011 06:48:22 -0000 Maybe related to http-auth WG. ---------- Forwarded message ---------- From: Eran Hammer-Lahav Date: 2011/5/10 Subject: [apps-discuss] HTTP MAC Authentication Scheme To: "apps-discuss@ietf.org" Cc: Ben Adida , "http-state@ietf.org" , OAuth WG , "Adam Barth (adam@adambarth.com)" , HTTP Working Group (Please discuss this draft on the Apps-Discuss mailing list) http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token The draft includes: * An HTTP authentication scheme using a MAC algorithm to authenticate requests (via a pre-arranged MAC key). * An extension to the Set-Cookie header, providing a method for associating a MAC key with a session cookie. * An OAuth 2.0 binding, providing a method of returning MAC credentials as an access token. Some background: OAuth 1.0 introduced an HTTP authentication scheme using HMAC for authenticating an HTTP request with partial cryptographic protection of the HTTP request (namely, the request URI, host, and port). The OAuth 1.0 scheme was designed for delegation-based use cases, but is widely =93abused=94 for simple client-server authentication (the poorly named =91two-legged=92 use case). This functionality has been separated from OAuth 2.0 and has been reintroduced as a standalone, generally applicable HTTP authentication scheme called MAC. Comments and feedback is greatly appreciated. EHL From yutaka@g.oiwa.jp Sat May 21 22:25:07 2011 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 424EBE0662; Sat, 21 May 2011 22:25:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HOrYcoMCNgB; Sat, 21 May 2011 22:25:06 -0700 (PDT) Received: from mail-pz0-f44.google.com (mail-pz0-f44.google.com [209.85.210.44]) by ietfa.amsl.com (Postfix) with ESMTP id 43584E0618; Sat, 21 May 2011 22:25:05 -0700 (PDT) Received: by pzk5 with SMTP id 5so3055734pzk.31 for ; Sat, 21 May 2011 22:25:05 -0700 (PDT) Received: by 10.68.16.3 with SMTP id b3mr1636170pbd.483.1306041905277; Sat, 21 May 2011 22:25:05 -0700 (PDT) Received: from [119.107.196.233] (wf01-119-107-196-233.uqwimax.jp [119.107.196.233]) by mx.google.com with ESMTPS id q2sm3521273pbk.49.2011.05.21.22.25.01 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 21 May 2011 22:25:04 -0700 (PDT) Sender: Yutaka OIWA Message-ID: <4DD89E2E.9040709@aist.go.jp> Date: Sun, 22 May 2011 14:25:02 +0900 From: Yutaka OIWA User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.2.17) Gecko/20110414 Thunderbird/3.1.10 MIME-Version: 1.0 To: "http-auth@ietf.org" Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Cc: Sean Turner , "saag@ietf.org" Subject: [http-auth] Identity in Browser, and HTTP-auth preparation X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 May 2011 18:10:25 -0000 Dear all, I'd like to restart preparing for the HTTP-auth BoF in IETF. Sorry for our slow progress. I'm now heading to San Francisco from Tokyo for the W3C identity in browser workshop, where our and others' related topics about Web identity will be presented. I'd like to have some more discussion for our strategy there. We're preparing our problem statement straw-man document, and I'd like to release it soon after IIB, possibly reflecting some of discussed topics in the workshop. I'll also attend OAuth interim meeting tomorrow, so please contact me if it is more preferable. Yutaka -- Yutaka OIWA, Ph.D. Research Scientist Research Center for Information Security (RCIS) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5]