Minutes for HTTPAUTH at IETF-93
minutes-93-httpauth-1

HTTPAuth Minutes

Matt L. stepped down, call for a new chair - talk to Yoav Nir or Kathleen.
Alternatively, feel free to propose yourself as a secretary.

Basic & Digest are in the RFC editor's queue waiting for the misref. MutualAuth
is stalled. Proposed a process to resolve multiple open issues around Mutual
Auth. Alexei Melnikov proposed to use Track Or GitHub for these issues. The new
process is accepted by the group.

Alexei on SCRAM
================
• Yoav: SHA-1 - are we in for a Discuss? Alexei: would like to share libraries,
and they are actually (other than OpenSSL) mostly SHA1. • Kathleen: will be
easier to pass IESG if we remove it. • Chris: the real advantage to SCRAM is
[missed]. Has no objection to taking SHA1 out. Alexei reluctantly agrees. •
Yukata: think that "stale" directive is needed. Alexei: this determines whether
client should provide a new password or just a new nonce, so it is needed. •
Call for help on implementing reauthentication. • Alexei: this can go WGLC
before Yokohama. • Tony Hansen: please fill in "base64" placeholders in text.
Alexei: this requires new examples, from Tony...

Rifaat on HTTP-Digest extensions (HMAC and salted hash)
========================================================
• Not a WG document, in fact not a doc yet.
• Yutaka: does not necessarily give more security. Need more detail in the
Security Considerations. • Rifaat: salt enables to change database if secret is
compromised. Yutaka: salt is not the right solution. • [missed] on compromise,
you only change the salt. Users are NOT expected to change their password. •
Yaron: why are we introducing a MAC (HMAC). • Yutaka: should not deploy this
solution unless we describe what to do on a compromise. • Kenny Patterson: HMAC
does not add anything on top of hashing. • Yoav: So the group seems negative
about this idea. If you want to polish the proposal and try again, please
submit a draft.

Rifaat on HTTP authentication with SRP
=======================================
• Yutaka: similar function to Mutual Auth, could have used that framework to
implement this PAKE. • Rifaat: but SRP is widely implemented. • Yutaka: must
have channel binding to prevent phishing. • Kathleen: phishing scope is much
wider than it used to be. • Tony: suggest to use base64 encoding, similarly to
what Alexei did. • Yaron: the statement that this is resistant to dictionary
attacks on the server is incorrect.

Yutaka: published a new version on GitHub. Yoav: pull requests are a fine way
to manage changes.

Kathleen: no cookies left.

Meeting adjourned.