Mutual Authentication Protocol for HTTP
RFC 8120

Document Type RFC - Experimental (April 2017; No errata)
Last updated 2017-04-11
Replaces draft-oiwa-httpbis-mutualauth
Stream IETF
Formats plain text pdf html bibtex
Reviews
Stream WG state Submitted to IESG for Publication
Document shepherd Rifaat Shekh-Yusef
Shepherd write-up Show (last changed 2016-07-17)
IESG IESG state RFC 8120 (Experimental)
Consensus Boilerplate Yes
Telechat date
Responsible AD Kathleen Moriarty
Send notices to "Rifaat Shekh-Yusef" <rifaat.ietf@gmail.com>
IANA IANA review state Version Changed - Review Needed
IANA action state RFC-Ed-Ack
Internet Engineering Task Force (IETF)                           Y. Oiwa
Request for Comments: 8120                                   H. Watanabe
Category: Experimental                                         H. Takagi
ISSN: 2070-1721                                               ITRI, AIST
                                                                K. Maeda
                                                  Individual Contributor
                                                              T. Hayashi
                                                                 Lepidum
                                                                 Y. Ioku
                                                  Individual Contributor
                                                              April 2017

                Mutual Authentication Protocol for HTTP

Abstract

   This document specifies an authentication scheme for the Hypertext
   Transfer Protocol (HTTP) that is referred to as either the Mutual
   authentication scheme or the Mutual authentication protocol.  This
   scheme provides true mutual authentication between an HTTP client and
   an HTTP server using password-based authentication.  Unlike the Basic
   and Digest authentication schemes, the Mutual authentication scheme
   specified in this document assures the user that the server truly
   knows the user's encrypted password.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for examination, experimental implementation, and
   evaluation.

   This document defines an Experimental Protocol for the Internet
   community.  This document is a product of the Internet Engineering
   Task Force (IETF).  It represents the consensus of the IETF
   community.  It has received public review and has been approved for
   publication by the Internet Engineering Steering Group (IESG).  Not
   all documents approved by the IESG are a candidate for any level of
   Internet Standard; see Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc8120.

Oiwa, et al.                  Experimental                      [Page 1]
RFC 8120         Mutual Authentication Protocol for HTTP      April 2017

Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................3
      1.1. Terminology ................................................5
      1.2. Document Structure and Related Documents ...................6
   2. Protocol Overview ...............................................6
      2.1. Messages ...................................................7
      2.2. Typical Flows of the Protocol ..............................8
      2.3. Alternative Flows .........................................10
   3. Message Syntax .................................................12
      3.1. Non-ASCII Extended Header Parameters ......................12
      3.2. Values ....................................................13
           3.2.1. Tokens .............................................13
           3.2.2. Strings ............................................14
           3.2.3. Numbers ............................................14
   4. Messages .......................................................15
      4.1. 401-INIT and 401-STALE ....................................16
      4.2. req-KEX-C1 ................................................19
      4.3. 401-KEX-S1 ................................................19
      4.4. req-VFY-C .................................................20
      4.5. 200-VFY-S .................................................21
   5. Authentication Realms ..........................................21
      5.1. Resolving Ambiguities .....................................23
   6. Session Management .............................................24
   7. Host Validation Methods ........................................26
      7.1. Applicability Notes .......................................27
      7.2. Notes on "tls-unique" .....................................28
Show full document text