From nobody Thu Jun 18 05:29:46 2015 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C89341A8A03; Thu, 18 Jun 2015 05:29:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3-fEKUZn0GWu; Thu, 18 Jun 2015 05:29:43 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 587971A89D3; Thu, 18 Jun 2015 05:29:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.0.3.p3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150618122943.5809.33063.idtracker@ietfa.amsl.com> Date: Thu, 18 Jun 2015 05:29:43 -0700 Archived-At: Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-scram-auth-06.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2015 12:29:45 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : Salted Challenge Response (SCRAM) HTTP Authentication Mechanism Author : Alexey Melnikov Filename : draft-ietf-httpauth-scram-auth-06.txt Pages : 17 Date : 2015-06-18 Abstract: The secure authentication mechanism most widely deployed and used by Internet application protocols is the transmission of clear-text passwords over a channel protected by Transport Layer Security (TLS). There are some significant security concerns with that mechanism, which could be addressed by the use of a challenge response authentication mechanism protected by TLS. Unfortunately, the HTTP Digest challenge response mechanism presently on the standards track failed widespread deployment, and have had success only in limited use. This specification describes a family of HTTP authentication mechanisms called the Salted Challenge Response Authentication Mechanism (SCRAM), which addresses security concerns with HTTP Digest and meets the deployability requirements. When used in combination with TLS or an equivalent security layer, a mechanism from this family could improve the status-quo for HTTP authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-scram-auth-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jun 18 05:32:57 2015 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71F681A8A10 for ; Thu, 18 Jun 2015 05:32:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1pJKIJOtmUmV for ; Thu, 18 Jun 2015 05:32:55 -0700 (PDT) Received: from statler.isode.com (statler.isode.com [217.34.220.151]) by ietfa.amsl.com (Postfix) with ESMTP id 125391A8A03 for ; Thu, 18 Jun 2015 05:32:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1434630773; d=isode.com; s=selector; i=@isode.com; bh=J7rrCvvn9p4FeyeOaBIqUiAxNg5Ow/eVWPUP1g/9pt4=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=iLI/MyVKrRedGA4EVMVsjxuncmBDCvYpKhM4766wsIr4KsbzUkAS4qQuKrVqATk3yqgMc5 i+vNpIJUrbA40m2P3wjlikfV8BuqKJm2Gi0FhjZd9ij/9bC0U+DBQay32aXNH2TRwUZnU9 Uv+BEiFkZdN0eZnGuhLNwnpJgmwiL2c=; Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Thu, 18 Jun 2015 13:32:53 +0100 Message-ID: <5582BA64.3070404@isode.com> Date: Thu, 18 Jun 2015 13:32:36 +0100 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 To: http-auth@ietf.org References: <20150618122943.5809.33063.idtracker@ietfa.amsl.com> In-Reply-To: <20150618122943.5809.33063.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-scram-auth-06.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2015 12:32:56 -0000 On 18/06/2015 13:29, internet-drafts@ietf.org wrote: [snip] > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-06 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-scram-auth-06 I've changed the mandatory-to-implement SCRAM mechanism to be SCRAM-SHA-256 instead of SCRAM-SHA-1. Also did a few fixes to the ABNF.