From nobody Mon Mar 7 23:10:39 2016 Return-Path: X-Original-To: http-auth@ietfc.amsl.com Delivered-To: http-auth@ietfc.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfc.amsl.com (Postfix) with ESMTP id ED2CC1CE142 for ; Mon, 7 Mar 2016 23:10:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfc.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.41]) by localhost (ietfc.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kFc52C3sdAEO for ; Mon, 7 Mar 2016 23:10:38 -0800 (PST) Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfc.amsl.com (Postfix) with ESMTPS id D66E21CD88A for ; Mon, 7 Mar 2016 23:10:37 -0800 (PST) Received: by mail-wm0-x22d.google.com with SMTP id l68so137245217wml.0 for ; Mon, 07 Mar 2016 23:10:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=MO6BDBe3EJybZzUepvOrf4h7v4iUeOQ6J9lB4xx6OaA=; b=GEr7Btl/VkJgwwN5jwN0AOzzTYox8kT07kAwrvNKVZdQQUfhNuedL1ULFnV/nUfFju HYm5VYHnVY6BCeOkkC4LMVLPzMTJo1ZaMlcU4P7KOlDZJwWDYIHHLAwO+ATQU2PANi6/ BUpmHD2ojDOeEXtS7f6W0dN/eLgqBeradCCds2ktVHxETB00QAMG03p65cQvLYLPgmR+ BSC4MpP9GR1TFC0WIdNq/X6HzNePnuKsjsN+Fq0UNX0Ei1PZO35uMZJib4FJbpCbdGMP BUgVqAPztbj4fjEqX55EqUjbpqJioyLM8mhnc3Q9F3QgwfoRgTT1k6W2mVGQ8tf/fqZx /juQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=MO6BDBe3EJybZzUepvOrf4h7v4iUeOQ6J9lB4xx6OaA=; b=c/dfJQKCVcEGaGlKuBLAPp4KNdiitygRMkXh0/imnC6gnihwA+KkAPmj1ir+cXbR7r zLk518WI6Ng0HzsibgHJ0GrCtY2d9UkpTuAYVjs/NaTMsOgWuOdGJlBMYqN1xrrcoGlE wcxN6trQ3/EhjGoVvfkNPpYMB8+waoiJz8zk2zKrrqFLUIbR0BwRC8kVP46KLxUa9JWx VwM3vpX+2aV20/jNswaPvIoBMTBcUzhqceqGp9xNt6vSHnaUcfx5zoCISXvF47rQOZy1 z1+6PKWuIWvtjhWAb3pFx29aMFQDPzupkoho/Z4E/awIe8/MmSuzhijIvYXZUDFyCpxg 13JA== X-Gm-Message-State: AD7BkJJZ9y5ZDJLk1ILdBzLk8Wsl87ZLKOJ1fL3SWHJo2WJuYXJokMDOlteLtITh1vHzfQ== X-Received: by 10.194.75.232 with SMTP id f8mr28944036wjw.83.1457421036418; Mon, 07 Mar 2016 23:10:36 -0800 (PST) Received: from yoavs-mbp-2.mshome.net ([176.13.4.146]) by smtp.gmail.com with ESMTPSA id k125sm17124657wmb.14.2016.03.07.23.10.29 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 07 Mar 2016 23:10:35 -0800 (PST) From: Yoav Nir Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <512C36C6-B86D-46FE-B5FD-A2342762EDB9@gmail.com> Date: Tue, 8 Mar 2016 09:10:21 +0200 To: httpauth mailing list Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) X-Mailer: Apple Mail (2.3112) Archived-At: Subject: [http-auth] Looking for Volunteers X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 07:10:39 -0000 Note: Cross-posted to SAAG and HTTPbis. Apologies if you have received = this twice or thrice Hi all The HTTP-Auth working group has been working on a set of three documents = for a mutual authentication method for HTTP. These documents are: * draft-ietf-httpauth-mutual-06 * draft-ietf-httpauth-mutual-algo-04 * draft-ietf-httpauth-extension-05 =20 The documents are feature complete. However, neither the authors nor the=20= WG chairs are native English speakers, and we would like to have the=20 language of these documents improved before proceeding to WG and IETF = last calls.=20 =20 If anyone would like to volunteer to read one or more of these documents and help us improve grammar and readability, we would appreciate this = very much. As always in the IETF, substantive comments and nits are always welcome as well.=20 =20 So if you're interested and are able to perform a language review on one = or more of these documents please contact one of the chairs directly.=20 =20 Thanks in advance, =20 Yoav and Rifaat HTTP-Auth Chairs= From nobody Tue Mar 8 11:26:21 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8842912D830; Tue, 8 Mar 2016 11:26:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kp8nl9MwgMhJ; Tue, 8 Mar 2016 11:26:16 -0800 (PST) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F27DA12DA15; Tue, 8 Mar 2016 11:26:09 -0800 (PST) Received: by mail-wm0-x230.google.com with SMTP id p65so41679304wmp.0; Tue, 08 Mar 2016 11:26:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3VVDG0zOhgkUNKY2Qyq8skUJy39wcByNaidYvvsrDMQ=; b=bIISrYE2AVvkZbNKPUSWN/nDDU2ZrKr2nrNbkOSmoqHej8AWNVHBCh8Vt7tBZnw43Z catH2XaG8ULs70ZGUvkyvYCJD1FB0J+Ew8UeEyiq4q0cVvn7yobmvQGhlg0LDH+UXwyx bDp8cXTMGdQkM90AEeeNp9tHpQDI3JbwRC91oaOPafzc0AImCSLRh0Pig/4uZhsnOyJc h8SfmgwaX8HSHbJI1juhdWzcpCrgyO/BCfZFP6EV5CQ66hOD+ASaKGIHgI8toe6ilNHE 2q8C+2zCwTPdeWcSeMeR2XRzH2QAK9t9vHA9HI0jAyqzKTk3ZE/7mpaGpSKxDXbhebcu /mhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3VVDG0zOhgkUNKY2Qyq8skUJy39wcByNaidYvvsrDMQ=; b=IFJoFFTInI5vmjyfzwJkc2XAPtO+fYBSZYOxXY1KDFGP0D8dGoQxSSunCS4i71omTR OrbHWNM+sVe9qcJe3MLwi4pFnUHKOZReBJSQ8NOkxMHgKYGt2Y0PACXfrlu0eZbyCW5T 6Q6X2P8FBOzXzuY34hqAMwL2+bQcuhx7BZprvfGvNZkgTblgxDUa+spMrk6ZoVRW+uug oPjqsuchfZ88S2rJ6zu8Y15G45T+LzUfvYzvn+2wJgunCi2bAi6NYgSpmvtoLAup/2VK aEC1SZY8aKi2t7dyxiXenpc6VjDeWcUlGr8DYMeoDKR6lue+S3p2NPs4K++ZOMAfZ2xg oxag== X-Gm-Message-State: AD7BkJKpT5cQzPxaV7JGOWdHxzk6BvM+oTW5hM8nLNE6D7o9ePNSgBD6zEoHPYUawh4O0w== X-Received: by 10.194.71.46 with SMTP id r14mr33850915wju.100.1457465168550; Tue, 08 Mar 2016 11:26:08 -0800 (PST) Received: from [192.168.1.13] ([46.120.13.132]) by smtp.gmail.com with ESMTPSA id k125sm20110147wmb.14.2016.03.08.11.26.07 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 08 Mar 2016 11:26:07 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) From: Yoav Nir In-Reply-To: <5B6E3BE2-3EF2-4262-AB34-54B54787009E@gmail.com> Date: Tue, 8 Mar 2016 21:26:05 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <7D8A8D66-8259-4659-9BE2-E96C38B051BF@gmail.com> References: <5B6E3BE2-3EF2-4262-AB34-54B54787009E@gmail.com> To: Security Area Advisory Group , httpauth mailing list , HTTP Working Group X-Mailer: Apple Mail (2.3112) Archived-At: Cc: Peter Yee , Cory Benfield , Melinda Shore Subject: Re: [http-auth] MutualAuth: Looking for Volunteers X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 19:26:17 -0000 Note: This time it=E2=80=99s cross-posted for real, so please don=E2=80=99= t reply-all to this message. Thanks to all who volunteered. It=E2=80=99s always great to see how much = help you can get at the IETF just by asking. Peter, Melinda and Cory volunteered first, and they will be reviewing = our three documents. Other reviews are, as always, welcome Thanks again to everyone, and especially to Peter, Melinda and Cory. Yoav & Rifaat On 8 Mar 2016, at 9:10 AM, Yoav Nir wrote: > Hi all >=20 > The HTTP-Auth working group has been working on a set of three = documents for > a mutual authentication method for HTTP. These documents are: > * draft-ietf-httpauth-mutual-06 > * draft-ietf-httpauth-mutual-algo-04 > * draft-ietf-httpauth-extension-05 >=20 > The documents are feature complete. However, neither the authors nor = the=20 > WG chairs are native English speakers, and we would like to have the=20= > language of these documents improved before proceeding to WG and IETF = last > calls.=20 >=20 > If anyone would like to volunteer to read one or more of these = documents > and help us improve grammar and readability, we would appreciate this = very > much. As always in the IETF, substantive comments and nits are always > welcome as well.=20 >=20 > So if you're interested and are able to perform a language review on = one or > more of these documents please contact one of the chairs directly.=20 >=20 > Thanks in advance, >=20 > Yoav and Rifaat > HTTP-Auth Chairs From nobody Wed Mar 9 05:34:14 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC97912DE2A for ; Wed, 9 Mar 2016 05:34:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lukasa-co-uk.20150623.gappssmtp.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G-CZVrohp4V9 for ; Wed, 9 Mar 2016 05:34:09 -0800 (PST) Received: from mail-wm0-x234.google.com (mail-wm0-x234.google.com [IPv6:2a00:1450:400c:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D888512DE3F for ; Wed, 9 Mar 2016 05:34:02 -0800 (PST) Received: by mail-wm0-x234.google.com with SMTP id l68so192805870wml.0 for ; Wed, 09 Mar 2016 05:34:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lukasa-co-uk.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:message-id:references:to; bh=1oi5K3w+y63HFMn6QLog6lhBymTfLPbPgh83G97tCgc=; b=RtJD9qE/YxvLYzVG6kF9ljqMPokhzmcT4uAN2cADyvmMDWg8fsVc6VWv2iisaJ59MT Po5tQ6kAb38WNa+RHo/coS7V5CYd0LX3bxg0SfhOLm9J02k/XPYlreWB3ks1EDAEEN8r Yq/mxtcejNVBAtlqyWY5/DRcOXc3v1pcxgk3uMkGNpl5Wy9Rx8w++v51LrWIBg5y2AK7 VQjZ+nKzimGBGmjOrJ4AXigdsFaKo9Ltkg/WTD1XVCHl9Z2/0eUhBCUkLvF59YTQ2iHW yMEAEc6iC7M6mh32ZObSRo9kzlMyDymkU0yOlv6qbqIMX2Bzbud2UsbbSiNgdht0rza0 iM1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :message-id:references:to; bh=1oi5K3w+y63HFMn6QLog6lhBymTfLPbPgh83G97tCgc=; b=aQ0eFB+liG+T7uS8bgow44GOkoCpzk4WZEx/QNVDfM/qU3GDzQuMgr/HisA/sBkWdG DreAXjGaw9VTP/bUJR5oHSCpiAunjFEZbcyo65juLZBbKOph5p+TsGdFC/T7lJFHMtqv vhFHScG5LLbQ7xb1SL0eJqRuHyFjQLEcsvEaj4xgh0/Zr7SCmQKHLe1t7YX5D4YZZJWk xHviUlg81FejN0hNJzUH/1j2XOsBQlm5C0KloetLa0k7oaaZ7VqD6Xq7cyOy4Z5LkL5c aaTgQ/dDi5zWggjaNFa69otUlreCCNx++G4FZb1anAL2zwJnr29kAN0fEtOPtBjZT+Tr 11xw== X-Gm-Message-State: AD7BkJKlKhQ+/XD/VWdCvYCDUxCRZC6X9vz+UlNhFBHS1jInaFcyQrELHwRqsja4gJ6enA== X-Received: by 10.28.213.66 with SMTP id m63mr26739839wmg.2.1457530441263; Wed, 09 Mar 2016 05:34:01 -0800 (PST) Received: from [192.168.1.6] (157.4.198.146.dyn.plus.net. [146.198.4.157]) by smtp.gmail.com with ESMTPSA id y3sm23806348wmy.17.2016.03.09.05.34.00 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 09 Mar 2016 05:34:00 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_AF54A43B-F469-42A3-9BC6-CF35DB387DED"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Pgp-Agent: GPGMail 2.6b2 From: Cory Benfield In-Reply-To: <7D8A8D66-8259-4659-9BE2-E96C38B051BF@gmail.com> Date: Wed, 9 Mar 2016 13:33:58 +0000 Message-Id: References: <5B6E3BE2-3EF2-4262-AB34-54B54787009E@gmail.com> <7D8A8D66-8259-4659-9BE2-E96C38B051BF@gmail.com> To: Yoav Nir , httpauth mailing list X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [http-auth] MutualAuth: Looking for Volunteers X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 13:34:12 -0000 --Apple-Mail=_AF54A43B-F469-42A3-9BC6-CF35DB387DED Content-Type: multipart/mixed; boundary="Apple-Mail=_33BB7B97-AB44-4A1E-8AED-A64FB1C0D2FE" --Apple-Mail=_33BB7B97-AB44-4A1E-8AED-A64FB1C0D2FE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 8 Mar 2016, at 19:26, Yoav Nir wrote: >=20 > Note: This time it=E2=80=99s cross-posted for real, so please don=E2=80=99= t reply-all to this message. >=20 > Thanks to all who volunteered. It=E2=80=99s always great to see how = much help you can get at the IETF just by asking. >=20 > Peter, Melinda and Cory volunteered first, and they will be reviewing = our three documents. Other reviews are, as always, welcome >=20 > Thanks again to everyone, and especially to Peter, Melinda and Cory. >=20 > Yoav & Rifaat >=20 [Removing HTTPBis and Security Area from reply] Following up on this, I have a batch of notes for = draft-ietf-httpauth-extension-05. Currently these are in list form = attached to this mail: for anyone who finds the attachment has been = stripped, feel free to find the notes here[0]. Mostly these notes are in = the form of =E2=80=9Cfor the phrase X, change to phrase Y=E2=80=9D. Some = involve basic word replacement. A few have more free-form questions or = responses, when I was either not able to understand the phrase well = enough to propose a replacement, or when more substantial review of a = sentence might be required. The notes are broken out by section. Each note is sequential in the = section: that is, the notes are in the order of the phrases in that = section. The notes are *not* broken up by subsection to avoid the = nesting getting too extreme. A very few notes say =E2=80=9CThis chunk appears in more than one = place=E2=80=9D. They always identify which section or sub-section has = the same phrase recurring. The phrase should be changed in all places it = appears in that section. Please let me know if it=E2=80=99d be more convenient for me to make = these changes against a copy of the draft and then provide my changed = copy of the draft in its entirety, rather than as 300-line file! I hope this feedback is valuable, and please let me know if you need = anything else, Cory [0]: https://gist.github.com/Lukasa/2563d76f64a7d161335f --Apple-Mail=_33BB7B97-AB44-4A1E-8AED-A64FB1C0D2FE Content-Disposition: attachment; filename="Notes on draft-ietf-httpauth-extension-05.txt" Content-Type: text/plain; name="Notes on draft-ietf-httpauth-extension-05.txt" Content-Transfer-Encoding: quoted-printable - Notes on draft-ietf-httpauth-extension-05 - Abstract - =E2=80=9CThis document specifies a few extensions=E2=80=9D= - The =E2=80=9Ca few=E2=80=9D feels informal to = me: consider removing. - =E2=80=9Cfundamental features of HTTP-level = authentication is not enough for complex=E2=80=9D - s/is not enough/are insufficient/ - =E2=80=9CThis makes these applications to implement" - s/makes/forces/ - =E2=80=9Cuser-agent clients=E2=80=9D - Are there non-user-agent clients? If not, = remove =E2=80=9Cclients=E2=80=9D and just use =E2=80=9Cuser-agents=E2=80=9D= . - 1. Introduction - =E2=80=9Cto provide enough functionality=E2=80=9D - Remove the word =E2=80=9Cenough=E2=80=9D. - =E2=80=9CWeb-sites=E2=80=9D - Generally this is rendered in English as = =E2=80=9Cwebsites=E2=80=9D, one word with no leading capital letter. - =E2=80=9CHTTP Basic (and Digest, too)=E2=80=9D - Change to =E2=80=9CHTTP Basic and Digest=E2=80=9D= . - =E2=80=9C(including a good-feeling user interfaces)=E2=80= =9D - Change to =E2=80=9C(including good user = interfaces)=E2=80=9D. - =E2=80=9Cto support most of realistic=E2=80=9D - Remove the word =E2=80=9Cof=E2=80=9D. - =E2=80=9CHowever, the method is=E2=80=9D - s/the/this/ - =E2=80=9Cbecause the whole behavior of the = implementation=E2=80=9D - Change to =E2=80=9Cbecause all of the = implementation=E2=80=9D - =E2=80=9Cserver-side applications=E2=80=9D - Change to =E2=80=9Cserver-side application=E2=80= =9D. - =E2=80=9Cnon-mandatory, optional authentication on = HTTP=E2=80=9D - Change to =E2=80=9Coptional HTTP = authentication=E2=80=9D. This is because =E2=80=9Cnon-mandatory=E2=80=9D = and =E2=80=9Coptional=E2=80=9D mean the same thing. - 2. Definitions - =E2=80=9Cmay involve with several=E2=80=9D - Replace with =E2=80=9Cmay involve several=E2=80=9D= . - For new terminology: - It=E2=80=99s somewhat confusing that the = authors use a bulleted list for requests and a numbered list for = responses. I recommend using numbered lists in both places. - =E2=80=9CA non-authenticated response: is=E2=80=9D - Remove the colon. - This should be done for every list item in the = new response terminology. - =E2=80=9Cinvolve with any HTTP authentication=E2=80=9D - Replace with =E2=80=9Cinvolve any HTTP = authentication=E2=80=9D. - =E2=80=9CIt may not contain any WWW-Authenticate=E2=80=9D= - Is this may not, or does not? - =E2=80=9Cnot-authentication-related=E2=80=9D - s/not/non/ - =E2=80=9Cconsidered as non-authenticated=E2=80=9D - Remove =E2=80=9Cas=E2=80=9D. - =E2=80=9Cprotected by HTTP authentication=E2=80=9D - Change to =E2=80=9Cprotected by a HTTP = authentication=E2=80=9D. - =E2=80=9Crequest is non-authenticating=E2=80=9D - Change to =E2=80=9Crequests is a = non-authenticating=E2=80=9D - =E2=80=9Cdirected to the protection space (realm) = other than the server=E2=80=99s expected one=E2=80=9D - Change to =E2=80=9Cdirected to a protection = space (realm) other than the one the server expected=E2=80=9D. - =E2=80=9CUpon reception" - Change to =E2=80=9CUpon receiving this = response=E2=80=9D - =E2=80=9CIf the client may have no prior knowledge on = authentication=E2=80=9D - Change to =E2=80=9CIf the client has no prior = knowledge of authentication=E2=80=9D - =E2=80=9Cclient already have an enough authentication = credentials=E2=80=9D - Change to =E2=80=9Cclient already has enough = authentication credentials=E2=80=9D - =E2=80=9Crequires an authentication=E2=80=9D - Change to =E2=80=9Crequires authentication=E2=80= =9D. - =E2=80=9Crequires some more reaction=E2=80=9D - Change to =E2=80=9Crequires more action=E2=80=9D= - =E2=80=9Cwithout another authentication credential=E2=80= =9D - Change to =E2=80=9Cwithout a different set of = authentication credentials=E2=80=9D - =E2=80=9Cof the currently-using credentials=E2=80=9D - Change to =E2=80=9Cof the active = credentials=E2=80=9D - =E2=80=9CClient can distinguish it by=E2=80=9D - Change to =E2=80=9CClients can distinguish = negatively-authenticated responses from authentication-initializing = responses by=E2=80=9D - =E2=80=9Cspecifying syntax of header values" - Change to: =E2=80=9Cspecifying the syntax of = header values=E2=80=9D - =E2=80=9Cuses the following syntax elements following = syntax definitions=E2=80=9D - Change to =E2=80=9Cuses the following syntax = definitions=E2=80=9D - =E2=80=9Cuse the extension-tokens with format=E2=80=9D - Change to =E2=80=9Cuse extension-tokens with = the format=E2=80=9D - 3. Optional Authentication - =E2=80=9Cit is implemented using HTTP cookies" - Change to =E2=80=9Cthis functionality is = implemented using HTTP cookies=E2=80=9D - =E2=80=9Ccustom form-based authentications=E2=80=9D - Change to =E2=80=9Ccustom form-based = authentication=E2=80=9D - =E2=80=9CServers MAY send successful HTTP responses = (response code 200, 206 and others)=E2=80=9D - Aren=E2=80=99t all 2XX codes successful? If = not all 2XX codes are able to use the Optional-WWW-Authenticate header, = this section should probably explain why not. Otherwise, change to = =E2=80=9CServers MAY send successful HTTP responses (any 2XX response = code)=E2=80=9D - =E2=80=9Cwhen it is an authentication-initializing = response=E2=80=9D - Change to =E2=80=9Cwhen the response is = authentication-initializing=E2=80=9D. - =E2=80=9CMUST NOT be contained in 401 responses=E2=80=9D= - Change to =E2=80=9CMUST NOT be sent on 401 = responses=E2=80=9D - May a server send it on 404s or other status = codes? It may be better to whitelist the allowed status codes rather = than specifically blacklist 401. - =E2=80=9Ca 401 responses corresponding for a same = request" - Change to =E2=80=9Ca 401 response = corresponding to the same request=E2=80=9D. - =E2=80=9CFailure to comply this rule will make client = not able to distinguish=E2=80=9D - Change to =E2=80=9CFailure to comply with this = rule will render clients unable to distinguish=E2=80=9D - =E2=80=9CWhenever an authentication scheme support for = servers to send some parameter" - Change to =E2=80=9CWhenever an authentication = scheme supports servers sending some parameter=E2=80=9D - =E2=80=9Chint of URL space" - Change to =E2=80=9Chint of the URL space=E2=80=9D= - 4. Authentication-Control header - =E2=80=9Cwill be generated usually by the Web servers" - Change to =E2=80=9Cwhich will usually be = generated by web servers=E2=80=9D. - =E2=80=9CWWW-Authenticate (or = Optional-WWW-Authenticate defined in this extension) header=E2=80=9D - Change to =E2=80=9CWWW-Authenticate header (or = the Optional-WWW-Authenticate header defined in this extension)=E2=80=9D. - =E2=80=9Cdetermine the scheme and realm to perform an = authentication" - Change to =E2=80=9Cdetermine the scheme and = realm they will use to authenticate=E2=80=9D - =E2=80=9Cand the entries corresponding to the scheme = and real will be meaningful=E2=80=9D - I don=E2=80=99t understand what this is = attempting to say, so it=E2=80=99s hard for me to correct the language. = Consider rewording or removing. - =E2=80=9Cthe scheme and a realm" - Change to =E2=80=9Cthe scheme and realm=E2=80=9D= - =E2=80=9CMUST NOT contain the duplicated parameters=E2=80= =9D - Change to =E2=80=9CMUST NOT contain duplicated = parameters=E2=80=9D - =E2=80=9Cit is encouraged t be sent=E2=80=9D - Change to =E2=80=9Cimplementations SHOULD send = the parameter=E2=80=9D - =E2=80=9CIf it is defined as a token=E2=80=9D - Change to =E2=80=9CIf the parameter is defined = as a token=E2=80=9D - =E2=80=9Cand is encouraged to be sent in an unquoted = form" - Change to =E2=80=9Cand SHOULD be sent in an = unquoted form=E2=80=9D - =E2=80=9CServer-side application SHOULD always be = reminded that=E2=80=9D - Change to =E2=80=9CServer-side applications = SHOULD always be reminded that=E2=80=9D. - Should there be normative language here? = It=E2=80=99s not clear what purpose it serves. Consider rewording to = something like: =E2=80=9CServer-side applications need to be aware = that=E2=80=9D - =E2=80=9Ccircumvent semantics of this header" - Change to: =E2=80=9Ccircumvent the semantics = of this header=E2=80=9D. - =E2=80=9CMUST be limited for providing some = non-fundamental=E2=80=9D - Change to: =E2=80=9CMUST be limited to = providing some non-fundamental=E2=80=9D - =E2=80=9CServer-side application MUST NOT rely=E2=80=9D - Change to: =E2=80=9CServer-side applications = MUST NOT rely=E2=80=9D - =E2=80=9Cthe field MUST be sent in clear using plain = RFC 7235 syntax=E2=80=9D - Change to: =E2=80=9Cthe field MUST be sent in = the clear using plain RFC 7235 syntax=E2=80=9D - =E2=80=9CSuch parameter MUST have charset value of=E2=80= =9D - Change to: =E2=80=9CSuch a parameter MUST have = a charset value of" - =E2=80=9CThe same parameter must MUST NOT be sent = twice or more, those in both plain- and extended-syntax. - Change to: =E2=80=9CThe same parameter MUST = NOT use sent more than once, for both parameters in plain- and = extended-syntax.=E2=80=9D - =E2=80=9Cwith value =E2=80=9CRenee or France=E2=80=9D=E2= =80=9D - Change to: =E2=80=9Cwith value =E2=80=9CRenee = of France=E2=80=9D=E2=80=9D - =E2=80=9Cspecifies the server=E2=80=99s preferences = over user interface behavior=E2=80=9D - Change to: =E2=80=9Cspecifies the server=E2=80=99= s preferences for user interface behavior=E2=80=9D - =E2=80=9Cincluded in any kind of responses=E2=80=9D - Change to: =E2=80=9Cincluded in any kind of = response" - =E2=80=9Cusers refusing authentication request" - Change to: =E2=80=9Cusers refusing the = authentication request=E2=80=9D - =E2=80=9Cexpected to ask the user a password=E2=80=9D - Change to: =E2=80=9Cexpected to ask the user = for a password=E2=80=9D - =E2=80=9Cthen provide users opportunities to perform = authentication" - Change to: =E2=80=9Cthen provide users the = opportunity to perform authentication=E2=80=9D - =E2=80=9Cdefault behaviour for the clients is = implementation-dependant=E2=80=9D - Change to: =E2=80=9Cdefault behaviour for = clients is implementation-dependant=E2=80=9D - =E2=80=9Cresponse for authentication-initializing = response=E2=80=9D - Change to: =E2=80=9Cresponse for an = authentication-initializing response=E2=80=9D - =E2=80=9Calthough NOT RECOMMENDED=E2=80=9D - Change to: =E2=80=9Calthough this is NOT = RECOMMENDED=E2=80=9D - This chunk appears in more than one location = in section 4: change it throughout the section. - =E2=80=9CThe clients MUST ignore this parameter, when = a response" - Change to: =E2=80=9CClients MUST ignore this = parameter when a response=E2=80=9D - This chunk appears in more than one location = in section 4: change it throughout the section. - =E2=80=9CThe clients SHOULD ignore this parameter=E2=80=9D= - Change to: =E2=80=9CClients SHOULD ignore this = parameter=E2=80=9D - This chunk appears in more than one location = in section 4: change it throughout the section. - =E2=80=9Cit specifies that new authentication attempt = is not to be performed on this location for better user experience=E2=80=9D= - Change to: =E2=80=9Cit specifies that new = authentication attempts are not to be performed on this location in = order to improve the user experience=E2=80=9D - =E2=80=9Ca (Web content=E2=80=99s level) explicit = interaction of users is desired before authentications=E2=80=9D - Change to: =E2=80=9Can explicit user = interaction with the web content is desired before authentication=E2=80=9D= - =E2=80=9Cinstead of giving user an opportunity to = start=E2=80=9D - Change to: =E2=80=9Cinstead of giving the user = an opportunity to start=E2=80=9D - =E2=80=9Cthis parameter MUST ignored=E2=80=9D - Change to: =E2=80=9Cthis parameter MUST be = ignored=E2=80=9D - =E2=80=9Cbe used as any security measures" - Change to: =E2=80=9Cbe used as a security = measure=E2=80=9D - =E2=80=9Cthe user explicitly request a logout" - Change to: =E2=80=9Cthe user explicitly = requests a logout=E2=80=9D - =E2=80=9Cthe user requests to terminate an = authentication period" - Change to: =E2=80=9Cthe user requests = termination of an authentication period" - This chunk appears in more than one location = in section 4.5: change it throughout the section. - =E2=80=9Cauthentication credentials and states=E2=80=9D - Change to: =E2=80=9Cauthentication credentials = and state" - =E2=80=9Chas been passed from the time received" - Change to: =E2=80=9Chas passed since the time = this header was received=E2=80=9D - =E2=80=9Cthe long-term memories for the passwords=E2=80=9D= - Change to: =E2=80=9Cthe long-term memories for = passwords and password-related details=E2=80=9D - =E2=80=9Cscheme to be used has syntax limitation on = allowed user names" - Change to: =E2=80=9Cscheme to be used has a = syntax limitation on allowed user names=E2=80=9D - =E2=80=9CClient SHOULD ignore any values which do not = conform" - Change to: =E2=80=9CClients SHOULD ignore any = values which do not conform" - =E2=80=9Cbut doing it will give bad user" - Change to: =E2=80=9Cbut doing so will give bad = user=E2=80=9D - =E2=80=9Crequires specific style of text preparation" - Change to: =E2=80=9Crequires a specific style = of text preparation" - 5. Usage examples (informative) - =E2=80=9CIf this assumption is not hold, texts below = provides=E2=80=9D - Change to: =E2=80=9CIf this assumption is not = valid, the text below provides=E2=80=9D - =E2=80=9CWithout explicit notices=E2=80=9D - Change to: =E2=80=9CWhen not explicitly = specified=E2=80=9D - =E2=80=9Cregardless of authentication statuses" - Change to: =E2=80=9Cregardless of the = authentication status" - =E2=80=9Cmost of web pages are available for guest = (unauthenticated) users" - Change to: =E2=80=9Cmost web pages are = available for guest (unauthenticated) users=E2=80=9D - =E2=80=9Ccontents of these pages are customized" - Change to: =E2=80=9Cthe content of these pages = is customised=E2=80=9D - =E2=80=9Cdoes not need a specific actions upon = log-in=E2=80=9D - Change to: =E2=80=9Cdoes not require specific = actions upon log-in" - =E2=80=9Cavailable to authenticated users, Set up=E2=80=9D= - Change to: =E2=80=9Cavailable to authenticated = users, set up=E2=80=9D - This chunk appears in more than one place in = Section 5: change it throughout the section. - =E2=80=9CNo specific pages for authentication is = needed" - Change to: =E2=80=9CNo specific pages for = authentication are needed=E2=80=9D - =E2=80=9CIf the site will have one" - Change to: =E2=80=9CIf the site has one=E2=80=9D= - =E2=80=9CIf the site needs a specific actions upon = log-out" - Change to: =E2=80=9CIf the site requires = specific actions upon log-out=E2=80=9D - =E2=80=9CAll shown in the Case 1 are to be applied" - Change to: =E2=80=9CAll settings in Case 1 are = applied=E2=80=9D - =E2=80=9CIn the de-authentication pages=E2=80=9D - Change to: =E2=80=9CIn the de-authentication = page=E2=80=9D - =E2=80=9CIf there is any direct links to it" - Change to: =E2=80=9CIf there are any direct = links to the de-authentication page=E2=80=9D - =E2=80=9C(some announces, user notices=E2=80=9D - Change to: =E2=80=9C(some announcements, user = notices=E2=80=9D - =E2=80=9Cto all pages available to guest" - Change to: =E2=80=9Cto all pages available to = guests=E2=80=9D - =E2=80=9Cfor the specific log-in page, Set up" - Change to: =E2=80=9Cfor the specific log-in = page, set up=E2=80=9D - =E2=80=9CIf the site will have one" - Change to: =E2=80=9CIf the site has one=E2=80=9D= - This chunk appears in more than one place in = Section 5: change it throughout the section. - =E2=80=9CIf almost all pages in the target site = requires authentication=E2=80=9D - Change to: =E2=80=9CIf almost all pages in the = target site require authentication" - =E2=80=9Cor there are no needs to support both" - Change to: =E2=80=9Cor if there is no need to = support both" - =E2=80=9Cthe setting will become somewhat simple=E2=80=9D= - Change to: =E2=80=9Cthe settings become = simpler=E2=80=9D - =E2=80=9Can example to realize such a site" - Change to: =E2=80=9Can example for such a = site=E2=80=9D - =E2=80=9Call pages available to authenticated" - Change to: =E2=80=9Call pages available to = authenticated users=E2=80=9D - =E2=80=9CIn the current Web sites using Form-based = authentications=E2=80=9D - =E2=80=9CIn current web sites using form-based = authentication" - =E2=80=9CIn some cases, there will be some ambiguous = situations whether some functions are authorization management or = session management=E2=80=9D - Change to: =E2=80=9CIn some cases there will = be ambiguity about whether some functions are for authorization = management or for session management=E2=80=9D - =E2=80=9Cfor deciding which features to be used" - Change to: =E2=80=9Cfor deciding which = features to use=E2=80=9D - =E2=80=9Cthe main requirement for such feature" - Change to: =E2=80=9Cthe main requirement for = such a feature" - =E2=80=9Cprotect users from their consoles and = browsers hijacked=E2=80=9D - Change to: =E2=80=9Cprotect users from having = their consoles and browsers hijacked=E2=80=9D - =E2=80=9COn the other hand, the requirements is to = protect the server=E2=80=99s privilege=E2=80=9D - Change to: =E2=80=9COn the other hand, if the = requirement is to protect the server=E2=80=99s privilege=E2=80=9D - =E2=80=9Csupport both HTTP-layer and Form-based = authentications=E2=80=9D - Change to: =E2=80=9Csupport both HTTP-layer = and Form-based authentication" - =E2=80=9Cshould identify which authentication are used = for the session" - Change to: =E2=80=9Cshould identify which = authentication has been used for the session=E2=80=9D - =E2=80=9Cput the following things to the Web pages" - Change to: =E2=80=9Cadd the following things = to the web pages=E2=80=9D - =E2=80=9Cif users are not authenticated, it may have a = diversion for HTTP-level authentication" - =E2=80=9Cif users are not authenticated, the = page may have a diversion for HTTP-level authentication=E2=80=9D - =E2=80=9CUsers are identified for authorizations=E2=80=9D= - Change to: =E2=80=9CUsers are identified to = authorization=E2=80=9D - =E2=80=9Cboth ones should match" - Change to: =E2=80=9Cboth should match=E2=80=9D - =E2=80=9CCookie tied to an HTTP authentication" - Change to: =E2=80=9CCookie tied to HTTP = authentication=E2=80=9D - 6. Methods to extend this protocol - =E2=80=9CThe extension-tokens MUST be with format" - Change to: =E2=80=9CAny extension-tokens MUST = use the format=E2=80=9D - 8. Security Considerations - =E2=80=9CServer application implementer SHOULD" - =E2=80=9CThe server application implementer = SHOULD=E2=80=9D - =E2=80=9Cprotect server-side resources, such features = MUST=E2=80=9D - Change to: =E2=80=9Cprotect server-side = resources, this protection MUST=E2=80=9D - =E2=80=9CServer-side applications MUST be implemented = always considering that" - Change to: =E2=80=9CServer-side applications = MUST always consider that=E2=80=9D - A note: how will this normative language ever = be enforced? May be worth changing this to something non-normative. - =E2=80=9CEspecially, it SHOULD NOT be used" - Change to: =E2=80=9CMost importantly, the = =E2=80=9Cusername=E2=80=9D parameter SHOULD NOT be used=E2=80=9D - =E2=80=9Cin any case where the valid user names are = configured by its users=E2=80=9D - Change to: =E2=80=9Cin any case where the = valid user names are configured by users=E2=80=9D - Appendix A - =E2=80=9CThis section provides cross-reference table = about applicability of each features provided in this specification for = each kinds of responses described in Section 2.1=E2=80=9D - Change to: =E2=80=9CThis section provides a = cross-reference table showing the applicability of the features provided = in this specification to each kind of response described in Section = 2.1=E2=80=9D - Appendix B - =E2=80=9Cmeaning of WWW-Authenticate headers" - Change to: =E2=80=9Cthe meaning of = WWW-Authenticate headers" --Apple-Mail=_33BB7B97-AB44-4A1E-8AED-A64FB1C0D2FE-- --Apple-Mail=_AF54A43B-F469-42A3-9BC6-CF35DB387DED Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJW4CZHAAoJEHD+F/imQ+FbimYP/1QKQk4AHWEeEz15tBq3hdGG KRO7xYBiNxe+5XoDYh8Ffcot93WD8M1EnLXWRLMFPZLWLpsbzYhx6PpB2iZc8n5Y qzB5fazV+dgZqoLXUDEeRYteQCkwPeITihyZ16kcJfISh3ePXb3+lrfNxJdROioY /vC3/KY08IIwRRIYFPTAcxynsC0XMBiSLaAVfMe+Af7HrDpqqt4Jqa2IiljvBomP iu0yNwwF9T4/JN6JT9fAUqha0SesEJjUSmPrYGXBatv2I6HnPnmhdvYzw9bdIEBl pMLInIxA0SA89yb9iDMu9gDRskAUso6X5HVDf3nLThwJZodE3BqHlkhfVl8C6NNK IN8o0zUvvfQ0aG31JyF6cfb1x/RbaIE6Ih6rXxiU4IsZwlUH0zYQ3gftRRaVzACu NQLy+EpzIOaIrRLUE8pcTuBU4S83ssPBPZjM5rr+B4TZ/lP8iDbUw9KRlWU8K9/q 28odyUk4iDkmwvHk/oUIBsVjCTR7SWU21om4vf9vRb+SeOvplbLesBZfof2hT4c8 oPTZeO88q8yCFwN1vusWNHCfFG3nlbo9V4TKcaBV7j3pcGX7YdJ2LIZ96VDo2xy2 fDiBS8ltTf3oLZk5hJ0PB59y55tLfoS6CINKFSrteNVoZSl8G4oZwdc+H6w9NTzv Jcehg3/aO19xgrPde7D8 =leTo -----END PGP SIGNATURE----- --Apple-Mail=_AF54A43B-F469-42A3-9BC6-CF35DB387DED-- From nobody Wed Mar 9 11:02:16 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FF5E12D789; Wed, 9 Mar 2016 11:02:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.923 X-Spam-Level: X-Spam-Status: No, score=-106.923 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F0rIagkw2SnT; Wed, 9 Mar 2016 11:02:12 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53F7212D80E; Wed, 9 Mar 2016 11:02:12 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id C474D180452; Wed, 9 Mar 2016 11:01:55 -0800 (PST) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Message-Id: <20160309190155.C474D180452@rfc-editor.org> Date: Wed, 9 Mar 2016 11:01:55 -0800 (PST) Archived-At: Cc: drafts-update-ref@iana.org, http-auth@ietf.org, rfc-editor@rfc-editor.org Subject: [http-auth] RFC 7804 on Salted Challenge Response HTTP Authentication Mechanism X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 19:02:13 -0000 A new Request for Comments is now available in online RFC libraries. RFC 7804 Title: Salted Challenge Response HTTP Authentication Mechanism Author: A. Melnikov Status: Experimental Stream: IETF Date: March 2016 Mailbox: alexey.melnikov@isode.com Pages: 18 Characters: 39440 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-httpauth-scram-auth-15.txt URL: https://www.rfc-editor.org/info/rfc7804 DOI: http://dx.doi.org/10.17487/RFC7804 This specification describes a family of HTTP authentication mechanisms called the Salted Challenge Response Authentication Mechanism (SCRAM), which provides a more robust authentication mechanism than a plaintext password protected by Transport Layer Security (TLS) and avoids the deployment obstacles presented by earlier TLS-protected challenge response authentication mechanisms. This document is a product of the Hypertext Transfer Protocol Authentication Working Group of the IETF. EXPERIMENTAL: This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Fri Mar 11 15:11:31 2016 Return-Path: X-Original-To: http-auth@ietf.org Delivered-To: http-auth@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D80C12DD8D; Fri, 11 Mar 2016 15:05:32 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , X-Test-IDTracker: no X-IETF-IDTracker: 6.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160311230532.15028.81736.idtracker@ietfa.amsl.com> Date: Fri, 11 Mar 2016 15:05:32 -0800 Archived-At: X-Mailman-Approved-At: Fri, 11 Mar 2016 15:11:29 -0800 Cc: http-auth@ietf.org Subject: [http-auth] httpauth - Requested session has been scheduled for IETF 95 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2016 23:05:34 -0000 Dear Rifaat Shekh-Yusef, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. httpauth Session 1 (1:00:00) Wednesday, Afternoon Session II 1620-1720 Room Name: Buen Ayre B size: 125 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Hypertext Transfer Protocol Authentication Area Name: Security Area Session Requester: Rifaat Shekh-Yusef Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 50 Conflicts to Avoid: First Priority: ipsecme tls cfrg sipcore Second Priority: saag httpbis Third Priority: precis Special Requests: --------------------------------------------------------- From nobody Mon Mar 14 12:48:47 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E06F12D50C for ; Mon, 14 Mar 2016 12:48:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wOJznY8ZIh0B for ; Mon, 14 Mar 2016 12:48:43 -0700 (PDT) Received: from mail-wm0-x233.google.com (mail-wm0-x233.google.com [IPv6:2a00:1450:400c:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B096B12D751 for ; Mon, 14 Mar 2016 12:41:52 -0700 (PDT) Received: by mail-wm0-x233.google.com with SMTP id p65so116224765wmp.1 for ; Mon, 14 Mar 2016 12:41:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=m441ErVPaely+gzvLmdhl4Sg9V6/rMrrtzwVF02wZpA=; b=r4okDI+mhoQmrhbo7ixesLUsq3YwlL64NeGPZq4m2EkHo1zOrDjJkFWH0Pc/SDb19i H5jdQgR3KyII3jjXZx7KPm4DlqfwwCzxBydtXS4j8lbZBE9Aj3/1PrDHylN+a0mfQ2zt CZ9SOvOao556Hgb7AY0kJP5mpr03+WPfwWV2BMJt2922KTG7qpVHdbUAMqqNV3YgeyIF nR2lNGlLqyOBGgUSX373/FkYoBIOdmoaMLdDEfDPK4tr7zT9+emWADv2LdQJ5lqCyEzo piQgrALUTLjLqRyrdppFHfMVFxMPQc9QNJtA4LQM65ED1Ouqx8i1NTHYnmf/itXiljoL Q+jQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=m441ErVPaely+gzvLmdhl4Sg9V6/rMrrtzwVF02wZpA=; b=aRUpMr4C8QvRIWL9KNk3ziuxYZLLB3kZT+dvoWE+88gar2xlUjBT5dSUIAW3yVuOsm b95Ils8KvF3AmGBXg3HdWKA4DXZ4a1D0F1ENCvS7jJ8948a5ysRUQpDfki5TnWJ1C1XL 7y5dY2xdGKnPBk8y3CYQhBLKWTHU6f69cqNAVx/OXiso6z2zlbo9OOeiKBbIYr/XLaJG gveKmw4kMydIA5IxHml9BGz+CCWFXM3KN7hZ1Tg9dZngHAwABFXE+IDU8r/r4GMFfL3k kT5P/iaRvxFDEEbUBV7HB6RbRSuCLfYRgtYNtq7pvpo65mTm0Ws2fQnkWuDUGXrrpXRI xkQw== X-Gm-Message-State: AD7BkJJ2gsOTsBNeeFNJ0UJklOPYT43KYYGxt/zBJRz9JilITOkNPnZ80JLuIi/UXWi3pQ== X-Received: by 10.28.54.156 with SMTP id y28mr20545015wmh.63.1457984511215; Mon, 14 Mar 2016 12:41:51 -0700 (PDT) Received: from [192.168.1.13] ([46.120.13.132]) by smtp.gmail.com with ESMTPSA id 74sm17614805wmn.17.2016.03.14.12.41.49 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 14 Mar 2016 12:41:50 -0700 (PDT) From: Yoav Nir Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: <8F913F02-0817-4202-B237-272009BC4894@gmail.com> Date: Mon, 14 Mar 2016 21:41:48 +0200 To: httpauth mailing list Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) X-Mailer: Apple Mail (2.3112) Archived-At: Subject: [http-auth] Meeting in Buenos Aires X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Mar 2016 19:48:45 -0000 Hi all As you=E2=80=99ve no doubt seen, the working group will meet for 1 hour = on Wednesday, April 6th at 4:20p local time, in the Buen Ayre C room. If you have a subject that is relevant to the group, and you would like = to have a short slot to present it, please send a message to the chairs = and/or to the list. *** IMPORTANT NOTE *** Current working group business takes precedence. = As you know, we have requested reviews of the MutualAuth drafts. If = these reviews turn up issues that need discussing, we will devote as = much time as necessary in the meeting to cover those issues. IOW: = getting a slot on the posted agenda is no guarantee of getting actual = time in the meeting. Looking forward to seeing you all in Buenos Aires Rifaat and Yoav From sarah_cai2002@yahoo.com Tue Mar 15 21:00:23 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64EB412DF29 for ; Tue, 15 Mar 2016 21:00:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.499 X-Spam-Level: X-Spam-Status: No, score=0.499 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=yahoo.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1upjMMMQPrML for ; Tue, 15 Mar 2016 21:00:22 -0700 (PDT) Received: from nm50-vm7.bullet.mail.gq1.yahoo.com (nm50-vm7.bullet.mail.gq1.yahoo.com [67.195.87.247]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F56B12D87E for ; Tue, 15 Mar 2016 21:00:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1458100821; bh=/Oh9LZkKbHDPqS9jq8pRL21zKExwyqWlHvL4oRT19Zo=; h=Date:From:Reply-To:To:Subject:References:From:Subject; b=U3935cCWcGux1tPHrhCpEMI86OJv+PpkBW5tOdhzbDWQ962NbHwr0jAQcXItH+cZhwEJJcSOb9kckvhuem8XBJC91KQ9CLEevvC/P2dsHv0wF2uvtTIU3WG7tONsbf0KAdqj12P4yzzgPnNLQCbxTwYe1zmRPA9ZORrvGtWRWpxWcANpWAbtAthxHbu1Gf01Zmz/bMksblHX5KN3Ukg1gHFbFNiBqNeHSQo7Mj6FSQizusUCRDXi7d08MO6fY2KhNeIgiECIHhl/NABE7xekXr6srSFG3uq1guLok8i/LKvGOtGWU4BmFAMnzKBncqxaZ3Rw1O9mrIwmbxrI1ASqUA== Received: from [127.0.0.1] by nm50.bullet.mail.gq1.yahoo.com with NNFMP; 16 Mar 2016 04:00:21 -0000 Received: from [216.39.60.184] by nm50.bullet.mail.gq1.yahoo.com with NNFMP; 16 Mar 2016 03:57:32 -0000 Received: from [98.137.12.244] by tm20.bullet.mail.gq1.yahoo.com with NNFMP; 16 Mar 2016 03:57:32 -0000 Received: from [127.0.0.1] by omp1052.mail.gq1.yahoo.com with NNFMP; 16 Mar 2016 03:57:32 -0000 X-Yahoo-Newman-Property: ymail-4 X-Yahoo-Newman-Id: 972372.44377.bm@omp1052.mail.gq1.yahoo.com X-YMail-OSG: fSgXgscVM1lblevlvd9BNN0Gcm3XYYlSGqd2PTEWtH5Hi7F9_ZMlIC7wO0423RV 121.qvCAhWa0DLXW510vwLaYdfbpmpbuWkhNgSs.viOKxtToVJC8P7Uvb_KRq_5rWCWl0z4iUmZq 2MG4PMU1dXxQjcHqo5kXF4gctPjk3fENP.w.qW7BjL7r6FKAKb97sg2jclIMlDbFeeLvCQonUyZr 95HqHWUccXYJ1ou5pGGGMxQj7ipuJ10nHnZNRJxK_ubeEkr1RMuvUQpydvse0VUUSvycPw.1HQG4 MyCI2OPrEzAvg2ccFkrNUg2I1U.TyqI8O6OBxvU_6ddAg0bnwyiBGmfcJYXkJfA7_WroKsGxYp9Y sV_TuAxk4JfLv5oIrAd5O5hazqdTF1G6HrWr5CIjXqHKkmMyIZenfzqStORSeUBaCxH6spbQfepC CzovBmfywDpaXcUm97tCF9lt5dac9G_GCZukGulah9hdWNr4IpApIydbSVatYoOg.v9C92N5IYDs q0vt5D96oyZfLTiBHVplWZV3L8rY- Received: by 216.39.60.192; Wed, 16 Mar 2016 03:57:32 +0000 Date: Wed, 16 Mar 2016 03:57:32 +0000 (UTC) From: Sarah Cai To: "http-auth@ietf.org" Message-ID: <1703792165.840803.1458100652155.JavaMail.yahoo@mail.yahoo.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_840802_1227234233.1458100652153" References: <1703792165.840803.1458100652155.JavaMail.yahoo.ref@mail.yahoo.com> Archived-At: Subject: [http-auth] sender IP address modification X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Sarah Cai List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2016 01:12:21 -0000 ------=_Part_840802_1227234233.1458100652153 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =C2=A0 When an http request is sent from client to webserver, is there any = way the sending IP address can be modified to a fake IP address? ------=_Part_840802_1227234233.1458100652153 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
  When an http request is sent from client to webserver, is there any way the sending IP address can be modified to a fake IP address?
------=_Part_840802_1227234233.1458100652153-- From nobody Thu Mar 17 07:19:15 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5EA712D742 for ; Thu, 17 Mar 2016 07:19:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ihtfp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iWLMdCuCGgyU for ; Thu, 17 Mar 2016 07:19:06 -0700 (PDT) Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8128312D508 for ; Thu, 17 Mar 2016 07:19:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id 61B61E203F; Thu, 17 Mar 2016 10:19:03 -0400 (EDT) Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 23042-04; Thu, 17 Mar 2016 10:18:59 -0400 (EDT) Received: from securerf.ihtfp.org (IHTFP-DHCP-159.IHTFP.ORG [192.168.248.159]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (verified OK)) by mail2.ihtfp.org (Postfix) with ESMTPS id 7FE5CE2036; Thu, 17 Mar 2016 10:18:56 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ihtfp.com; s=default; t=1458224337; bh=aouD8+9r1LaJ7xUAOam5hVp3ob5M9MfFIDBAyEs3I5E=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=itenBGtuJ/cnqbWKuY1etlcWSb4rZnnyKjhmVIpowLostCzIwl7tZ7v2NbXXpmwEx LxmlutOeFCYmkAssQej6WLNRfyRj+/Alv4OvMXVwIYFJjXfifqa/2l7U36F7aWsQr4 k7iQnJUcMqEukLFXTqbsF+Cy6dRhJCsKSkTCsIag= Received: (from warlord@localhost) by securerf.ihtfp.org (8.15.2/8.14.8/Submit) id u2HEIthb003554; Thu, 17 Mar 2016 10:18:55 -0400 From: Derek Atkins To: Sarah Cai References: <1703792165.840803.1458100652155.JavaMail.yahoo.ref@mail.yahoo.com> <1703792165.840803.1458100652155.JavaMail.yahoo@mail.yahoo.com> Date: Thu, 17 Mar 2016 10:18:55 -0400 In-Reply-To: <1703792165.840803.1458100652155.JavaMail.yahoo@mail.yahoo.com> (Sarah Cai's message of "Wed, 16 Mar 2016 03:57:32 +0000 (UTC)") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Virus-Scanned: Maia Mailguard 1.0.2a Archived-At: Cc: "http-auth@ietf.org" Subject: Re: [http-auth] sender IP address modification X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2016 14:19:15 -0000 Sarah Cai writes: > When an http request is sent from client to webserver, is there any way the > sending IP address can be modified to a fake IP address? Yes, there are numerous ways to spoof an IP address, even with TCP. Some attacks require guessing TCP sequence numbers. Other attacks just require routability. -derek -- Derek Atkins 617-623-3745 derek@ihtfp.com www.ihtfp.com Computer and Internet Security Consultant From nobody Wed Mar 30 06:35:58 2016 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CDD012DC81 for ; Wed, 30 Mar 2016 06:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7EZvAGCFZGbv for ; Wed, 30 Mar 2016 06:35:44 -0700 (PDT) Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D552112D69B for ; Wed, 30 Mar 2016 06:28:55 -0700 (PDT) Received: by mail-wm0-x235.google.com with SMTP id 20so71339096wmh.1 for ; Wed, 30 Mar 2016 06:28:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:subject:date:message-id:cc:to:mime-version; bh=s5c40GoHyJMcF+JrUY+HWeTvjPXX/Y9aZcRH+AXamA8=; b=mYRjoGGELAo0+v59Xh5uuQ5qy6h5ZqzY57gdbVA8eFSfOXx+CyyALRqob1Md5O6SYv t6V/m2c9PoelK/pUl9oeHvbay6GhZavfgv90czEu/uoFKoelJiVFz6dgeS1X/aDVABol BbCOffjJ8Y8ymrpbOe6O6PX38lzoYdsmxlK15sxUIT2prl9cSGFJk5tY08n7uMaVH9LQ WCgjzw0Io0z4AwZW4zJ5zs5QbUiLjSwC7H4/NPYqrS3qHSOpaHfRyL+44TW2dx7coudd ftwU9R4+D9tOKCJVld7CS63knWuWwT1NoF2mG2sXfqmrjpvg72DlLZAzWbl9HYlXzKE/ uf2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:date:message-id:cc:to:mime-version; bh=s5c40GoHyJMcF+JrUY+HWeTvjPXX/Y9aZcRH+AXamA8=; b=PELAlZBlvndyq9vQbSnzP1F7c/L7du44gPc7igaqylze0DCGv6mTDwpkpFVXKaXtX/ RDYafg5HBUM5f10GeSVax3zhwDlU/MCVCd+QwlWaTwEBS8EqI/lncqsS1AiJ+gX7PnI5 vnxFQko27iNuV6ctrpeG0Iit35009FpVW3DKlI1RcbSRtO5orYr5wiPWnYGZTZ9xUdTV KaJIeIkDxYnmRQ1oB3lIEcqZMJC5O8l6rWNKubztfArVmKBH5yYLPC72rj1crOKD5OjN vR7mMU3nMxfq3N0uFXxNGZEWAyZ5nRVpZcZ07u0aImCMd7llBknm6kpChR3PNmjeAlvw Fg8g== X-Gm-Message-State: AD7BkJIgzsayIH9rijE+1JBM56pqOuSU0zA1aA8CNJTCLmRn/qvDnb7TmEg+Sd5QO6WfBQ== X-Received: by 10.28.9.19 with SMTP id 19mr24580887wmj.87.1459344533690; Wed, 30 Mar 2016 06:28:53 -0700 (PDT) Received: from [172.24.251.104] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id i5sm3974810wja.23.2016.03.30.06.28.52 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 30 Mar 2016 06:28:53 -0700 (PDT) From: Yoav Nir Content-Type: multipart/alternative; boundary="Apple-Mail=_CE197445-5524-4DC9-86C4-5D831CA4EA9C" Date: Wed, 30 Mar 2016 16:28:51 +0300 Message-Id: <226725CC-CB03-4B48-BD39-B02241D66B7F@gmail.com> To: httpauth mailing list Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Peter Yee Subject: [http-auth] Peter Yee's Review of draft-ietf-httpauth-mutual-06 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Mar 2016 13:35:51 -0000 --Apple-Mail=_CE197445-5524-4DC9-86C4-5D831CA4EA9C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi. Peter has reviewed the document, mostly for language (think of it as an = early gen-art review). The result is linked here, both as a Word document with markup and as = well as a couple of exported formats. Yoav Word format: = https://www.dropbox.com/s/xe1oj59vbrrppal/draft-ietf-httpauth-mutual-06.do= cx?dl=3D0 = PDF export: = https://www.dropbox.com/s/ueayvfiltghc58s/draft-ietf-httpauth-mutual-06.pd= f?dl=3D0 = HTML export: = https://www.dropbox.com/s/mygpd01f2kd9147/draft-ietf-httpauth-mutual-06.ht= ml?dl=3D0 = (apologies for the DropBox prompts to create an account. I did not want = to attach 1.5 MB worth of attachments to this message)= --Apple-Mail=_CE197445-5524-4DC9-86C4-5D831CA4EA9C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi.

Peter has reviewed the document, mostly for language = (think of it as an early gen-art review).

The result is linked here, = both as a Word document with markup and as well as a couple of exported = formats.

Yoav

Word format: https://www.dropbox.com/s/xe1oj59vbrrppal/draft-ietf-httpauth-m= utual-06.docx?dl=3D0
PDF export: https://www.dropbox.com/s/ueayvfiltghc58s/draft-ietf-httpauth-m= utual-06.pdf?dl=3D0
HTML export: https://www.dropbox.com/s/mygpd01f2kd9147/draft-ietf-httpauth-m= utual-06.html?dl=3D0

(apologies for the DropBox prompts to create an account. I = did not want to attach 1.5 MB worth of attachments to this = message)
= --Apple-Mail=_CE197445-5524-4DC9-86C4-5D831CA4EA9C--