From nobody Tue Jun 24 16:20:37 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDBB31B29A8 for ; Tue, 24 Jun 2014 16:20:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.78 X-Spam-Level: X-Spam-Status: No, score=-1.78 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 533OMNiSUc5f for ; Tue, 24 Jun 2014 16:20:34 -0700 (PDT) Received: from na3sys010aog112.obsmtp.com (na3sys010aog112.obsmtp.com [74.125.245.92]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E68F51A03AE for ; Tue, 24 Jun 2014 16:20:33 -0700 (PDT) Received: from mail-vc0-f170.google.com ([209.85.220.170]) (using TLSv1) by na3sys010aob112.postini.com ([74.125.244.12]) with SMTP ID DSNKU6oHwehHww2DjcwvFg3dRcW9znmREKKT@postini.com; Tue, 24 Jun 2014 16:20:34 PDT Received: by mail-vc0-f170.google.com with SMTP id hy10so1097437vcb.15 for ; Tue, 24 Jun 2014 16:20:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=mime-version:from:date:message-id:subject:to:content-type; bh=lPJQ5OvrU/QV/gUapvt72kO7IUoVSXY2iZtZLBG/HpI=; b=PvasZ5su76Abo+9zsNV3WDoeAe6uoFv98p+wpwybIegF5vMTYOMrkpXd5vNLDfCEUd ozbgV9xM07RiKWEgcfyDvHfBmeWO3SSYFAWgaJudWLCmjyBj+ne5rKoB0JsUeoqa5LeF yyKsJvXiU4wYJ0a5bW5T1ioDJm9myZHSgkmqo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-type; bh=lPJQ5OvrU/QV/gUapvt72kO7IUoVSXY2iZtZLBG/HpI=; b=azG1WejTmhexU1TzYCC5Tf5SmnExZvHUaBySRCYxfBqfYg8uSskhuQ9fWsY4yD/x8B GLNGG6FGkIgRPN15YEM3YrH/E9D1x4ovo8uIJN6+CbRGGAl1sxNVi5je9V0RsRfwIeg0 WwY4gtDSlaFa9Mbk/pXUcL8d2RP3Oyu1zTX9E56YHbYjk3Idf7GTsawKFPe2deqQhmXk zn2RTos11b6te9yTV6RiG2Z+wOL9QGKkGMq5qSfz3O0K8eYq0qFTireHqLG9OB7hlURM A98YXsaDhqytLOjJ2u/cyqPVJXQllM9LhVu6rKItiIcgz1xq/MQ7kMFHgi0qaqomSDDV u6DA== X-Gm-Message-State: ALoCoQkV6byHmeb9IvEFpJVahZyPqmNwkfEBw5GywwD4qE1ZHT5QWCbahFMSMTHR1XM0wZ+wMSzvOGlU1LiUf+k68qRJGVDD6qIMLhlPVSJl2CRfBLZ+6fE4IEn4ukGDaHEkKaO139YJ X-Received: by 10.52.252.193 with SMTP id zu1mr2785105vdc.7.1403652032894; Tue, 24 Jun 2014 16:20:32 -0700 (PDT) X-Received: by 10.52.252.193 with SMTP id zu1mr2785083vdc.7.1403652032511; Tue, 24 Jun 2014 16:20:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.58.141.170 with HTTP; Tue, 24 Jun 2014 16:20:12 -0700 (PDT) From: Yutaka OIWA Date: Wed, 25 Jun 2014 08:20:12 +0900 Message-ID: To: "http-auth@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/bxVReyIdRXyMR3169ugzvBqRpjk Subject: Re: [http-auth] [httpauth] #3 (mutual): A few issues with pwd-hash X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jun 2014 23:20:36 -0000 [resending to fix non-working reply address] Dear Matthew, thank you for managing on the issue tracker! I hope this will clarify which way we and our working group should work on. 2014-06-25 6:30 GMT+09:00 httpauth issue tracker : > #3: A few issues with pwd-hash > > Changes (by mlepinski.ietf@gmail.com): > > * status: new => closed > * resolution: => fixed > > > Comment: > > I am closing this issue. The domain issue appears to be resolved (see > Section 11.2 in the latest version of the document). > > The latest version of the document also clearly recommends "none" > > The working group has not been able to determine whether there is a > compelling need for other pwd-hash values other than "none". Inclusion of > those values in the experimental draft adds a bit of implementation > complexity, but otherwise appears harmless. > > -- > -------------------------------------+------------------------------------- > Reporter: ynir@checkpoint.com | Owner: draft-ietf-httpauth- > Type: defect | mutual@tools.ietf.org > Priority: major | Status: closed > Component: mutual | Milestone: > Severity: - | Version: > Keywords: pwd-hash hash legacy | Resolution: fixed > MD5 | > -------------------------------------+------------------------------------- > > Ticket URL: > httpauth > -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From nobody Tue Jun 24 16:25:43 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95A381B29B9 for ; Tue, 24 Jun 2014 16:25:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.679 X-Spam-Level: X-Spam-Status: No, score=-3.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U_DqB2k_0HBV for ; Tue, 24 Jun 2014 16:25:39 -0700 (PDT) Received: from na3sys010aog104.obsmtp.com (na3sys010aog104.obsmtp.com [74.125.245.76]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B80111B29B6 for ; Tue, 24 Jun 2014 16:25:39 -0700 (PDT) Received: from mail-ve0-f172.google.com ([209.85.128.172]) (using TLSv1) by na3sys010aob104.postini.com ([74.125.244.12]) with SMTP ID DSNKU6oI87tifcIMIr1MgM9LfT4uN9EVYcqx@postini.com; Tue, 24 Jun 2014 16:25:39 PDT Received: by mail-ve0-f172.google.com with SMTP id jz11so1153013veb.31 for ; Tue, 24 Jun 2014 16:25:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=r1h6+DW1fZAk2NRnWDSv5uW8uS+S3kFxMlHkZod5qTE=; b=tf4c/fFSlgzXWfLQ3GY6iFk5aAxRyBlGX8Us51tL8GHFmkEar51kDb9Ghs0O88mqTX 6G36Bl2L1g8YP7eHj654ci/6uue4cPN4dxBgk951Xdd0BQ+T7QbY+S2UCFiwYgBBLgm4 L+STnxg+Z/cPfjTZoBhU4dEpHdwKchLXrW4yo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-type; bh=r1h6+DW1fZAk2NRnWDSv5uW8uS+S3kFxMlHkZod5qTE=; b=c0fJ8kdVriyaY4IrfWLhE/T9EiOOpfruNs85X1Mj5L9+MgPKyW9TusX7Hv/QfrmpGq MpfdyjZVzrof2NUJHw1f/i1DPT34QWPOFgDCdwzzCMdQNqk6FuDtEeOaU7iHH5upxflM GetoMkj7ke0Ln+i6WE5mDlYNeqpiwGoqex00AR91sNoGUJ8ky5A7qnIRTLWJxcuAYEWd MrmHcxqUWwj/HwCgRQNKwPHc49ABcPwW5aIaA2fyhq/9047KVaW3EZRZ7bDU8wBmkc9u WY1131dExZwKBcrJtjNntjED/E8RYhtRMD+xYqBPKxQAQv4pIpwL1D35vO4LtQy7Df8e kB5g== X-Gm-Message-State: ALoCoQkBy8zFDt4eyVKkHpA9KfQ8KH/CRQZXLsDpQrxR5GT6snA2/ndikL6VmIl9IX9LEHuOQDnqvC46VdMpJZn5Rbw56AKa/TrfA+jFYarqOoWIsZXHLsBdc6k+mHGGyLXgDl3HRz9V X-Received: by 10.220.174.137 with SMTP id t9mr3395473vcz.12.1403652338904; Tue, 24 Jun 2014 16:25:38 -0700 (PDT) X-Received: by 10.220.174.137 with SMTP id t9mr3395463vcz.12.1403652338749; Tue, 24 Jun 2014 16:25:38 -0700 (PDT) MIME-Version: 1.0 Received: by 10.58.141.170 with HTTP; Tue, 24 Jun 2014 16:25:18 -0700 (PDT) In-Reply-To: References: From: Yutaka OIWA Date: Wed, 25 Jun 2014 08:25:18 +0900 Message-ID: To: Matthew Lepinski , "http-auth@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/_NAYZxDYa6BmBSY0yOTgTzhMZF8 Subject: [http-auth] Fwd: [Request for considerations] promote draft-oiwa-httpauth-mutual-algo to WG document X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jun 2014 23:25:41 -0000 Dear Matthew, Thank you again for working on the issue tracker! If possible, could I ask you one more thing: to register this to http-auth issue tracker as an open issue? We need to resolve this (either in our proposed way, or in some alternative way if declined) to make our drafts "complete" for implementation). ---------- Forwarded message ---------- From: Yutaka OIWA Date: 2014-03-05 23:48 GMT+09:00 Subject: [Request for considerations] promote draft-oiwa-httpauth-mutual-algo to WG document To: "http-auth@ietf.org" Dear all, Having had a short talk with WG Chairs on Monday, I'd like to request a companion draft for my Mutual auth proposal to be promoted for WG document. To implement my proposal, the content of this companion document (or something equivalent) is necessary. I have been considered between two options for handling of this document: to merge it with the main draft, or to keep it separate. What I'm requesting now is the latter way. The pros of keeping document separate is having a good cryptography agility. It can handle all possible cryptographic primitives in the class of "augmented PAKEs" as equally, and may promote a good competitions between such cryptographic primitives as TLS did for symmetric ciphers. The cons for doing that is that the total length of the documents will become slightly longer, and the understanding of the main draft slightly harder. The pros and cons of merging the two documents will be the opposite: it makes the total documents smaller, but it may gives a unintended feeling of that other augmented PAKE algorithms are very optional and non-default in future. If you have some opinions for/against my preference, please let us know for considerations. If many of you think that merging is better, I will consider it seriously. Chairs, please let me know anything we should do, further than sending this mail for the mailing list at this moment. -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5]