%% You should probably cite draft-schinazi-httpbis-unprompted-auth instead of this I-D.
@techreport{schinazi-httpbis-transport-auth-08,
    number =    {draft-schinazi-httpbis-transport-auth-08},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-schinazi-httpbis-transport-auth/08/},
    author =    {David Schinazi and David Oliver and Jonathan Hoyland},
    title =     {{HTTP Unprompted Authentication}},
    pagetotal = 9,
    year =      2022,
    month =     oct,
    day =       13,
    abstract =  {Existing HTTP authentication mechanisms are probeable in the sense that it is possible for an unauthenticated client to probe whether an origin serves resources that require authentication. It is possible for an origin to hide the fact that it requires authentication by not generating Unauthorized status codes, however that only works with non-cryptographic authentication schemes: cryptographic schemes (such as signatures or message authentication codes) require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication. This document proposes a new non-probeable cryptographic authentication scheme.},
}