Re: RFC2616 vs RFC2617, was: Straw-man charter for http-bis

[Keith Moore <[e-mail]>]

no.  deprecate 2617.  deprecate the framework that is in 2616.  HTTP
security needs a clean slate approach.
> maybe things become clearer if we consider re-organizing the security
> stuff?
>
> Currently,
>
> - RFC2616 refers (normatively?) to RFC2617 for authentication, and
>
> - RFC2617 defines a framework (Section 1.2) and two schemes (Basic and
> Digest).
>
> Assuming that there's no immediate need to change the framework
> defines in RCF2617, Section 1.2, wouldn't it make sense to:
>
> - Move the authentication framework itself into RFC2616bis, and
>
> - to then publish stand-alone documents upgrading/fixing both Basic
> and Digest?
>
> The benefits being:
>
> - RFC2616bis doesn't have the dependency on its sister spec anymore,
> which suffers from Basic and Digest problems, and
>
> - Basic, Digest and new schemes could evolve independently.
>
> Best regards, Julian
>
>
>