Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Barry Leiba <[e-mail]>]

>> This document would benefit from some section somewhere giving a set 
>> of clear, numbered steps, saying who sends, who receives, and who does 
>> what with what input at each step.  I will propose such text.
>
> And I'll happily look at that when it's available. (And hope to not have
> to wait much:-)

And here we go; not a lot, but I think it really helps.  Of course, adjust it if I got anything wrong or worded inaccurately.  Note how the section references jump around -- that's why I found it hard to follow, and why I think this is a big help.  I'm suggesting making this Section 1.3 because I think having it up front makes it the most useful.

-------------------------------------
1.3 An Overview of HOBA-http Authentication

HOBA authentication uses the HTTP authentication framework defined in 
[RFC7235], using a number of HOBA-specific elements.  This is a high-level 
overview of HOBA-http authentication:

1. If the user is not already registered with the web-origin and realm it is 
trying to access, the "joining" process is invoked (see Section 6.1).  This 
creates a key pair and makes the CPK known to the server.

2. The client connects to the server and makes a request, and the server's 
response includes a WWW-Authenticate header field that contains the "HOBA" 
auth-scheme, along with associated parameters (see Section 3).

3. The client uses the challenge from the HOBA auth-scheme parameters, along 
with other information it knows about the web-origin and realm, to create 
and sign a HOBA-TBS string (see Section 2).

4. The client creates a HOBA client-result (HOBA-RES), using the signed 
HOBA-TBS for the "sig" value (see Section 2).

5. The client includes the Authorization header field in its next request, 
using the "HOBA" auth-scheme and putting the HOBA client-result in an 
auth-param named "result" (see Section 3).

6. The server authenticates the HOBA client-result (see Section 5.3).

7. Typically, the server's response includes a session cookie that allows 
the client to indicate its authentication state in future requests (see 
Section 1.1).

[You might include an example here, as Julian suggests.  Or perhaps you might put an example in an appendix, and just cite it here.]

-------------------------------------

Please let me know what you think.

Barry