Re: [apps-discuss] [kitten] [saag] HTTP authentication: the next generation

Right, HTTP authentication is out of Abfab's scope. My point was that Abfab is doing stuff that may nonetheless be useful for some other effort looking at the problem.

I agree with your observation re federation, but note that EAP authentication does not imply federation.

Josh.

--- original message ---
From: "Yoav Nir" <ynir@checkpoint.com>
Subject: RE: [kitten] [saag] HTTP authentication: the next generation
Date: 12th December 2010
Time: 8:42:08 am

To quote from Abfab's charter:

                 This working group will specify a federated identity
  mechanism for use by other Internet protocols not based on HTML/HTTP,

For just adding authentication to HTTP, I don't think it makes sense to add federation. All kinds of services such as web mail, online gaming, and online shopping require authentication, but there's no federation involved.

-----Original Message-----
From: Josh Howlett [mailto:Josh.Howlett@ja.net]
Sent: 12 December 2010 10:30
To: Yaron Sheffer; Luke Howard
Cc: apps-discuss@ietf.org; pgut001@cs.auckland.ac.nz; Yoav Nir; websec; Paul Hoffman; kitten@ietf.org; http-auth@ietf.org; saag@ietf.org; Hannes Tschofenig; Josh Howlett; ietf-http-wg@w3.org Group
Subject: Re: [kitten] [saag] HTTP authentication: the next generation

AbFab is defining a GSS EAP mechanism that can encapsulate the EAP methods you mention. This mechanism could be run over SASL-TLS using GS2.

Josh.

--- original message ---
From: "Yaron Sheffer" <yaronf.ietf@gmail.com>
Subject: Re: [kitten] [saag] HTTP authentication: the next generation
Date: 12th December 2010
Time: 7:36:41 am

Hi Luke,

I am not a big fan of EAP myself (although I am a co-author on Yoav's TLS-EAP), but no, for pragmatic reasons SASL is not the moral equivalent.

There is a number of EAP methods that provide zero-knowledge password based mutual authentication (i.e. password based auth that's *not* susceptible to dictionary attacks). These include (see
http://www.iana.org/assignments/eap-numbers/eap-numbers.xml#eap-numbers-3)
EAP-SRP-SHA1, EAP-pwd, EAP-EKE and EAP-SPEKE.

As far as I can see
(http://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml)
SASL does not provide any equivalent method.

Thanks,
        Yaron

On 12/12/2010 03:38 AM, Luke Howard wrote:
>
> On 12/12/2010, at 10:10 AM, Yoav Nir wrote:
>
>>
>> On Dec 11, 2010, at 1:09 AM, Paul Hoffman wrote:
>>
>>> At 3:53 PM -0700 12/10/10, Peter Saint-Andre wrote:
>>>> Other than that, I'm not aware of much activity. What have I missed?
>>>
>>> TLS client certificates.
>>
>> TLS client certificates work, but as we've learned both with the web and with IPsec clients, people would much rather not use them. A few IETFs ago (Chicago?), a bunch of us tried to push the idea of TLS with EAP authentication.
>>
>> http://tools.ietf.org/html/draft-nir-tls-eap
>
> Does draft-williams-tls-app-sasl-opt-04.txt + abfab get you the moral equivalent?
>
> -- Luke
_______________________________________________
Kitten mailing list
Kitten@ietf.org
https://www.ietf.org/mailman/listinfo/kitten

JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

Scanned by Check Point Total Security Gateway.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG