[http-auth] Fwd: [apps-discuss] HTTP MAC Authentication Scheme

"KIHARA, Boku" <bkihara.l@gmail.com> Tue, 10 May 2011 06:48 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=e5c2/hdzI3ABn1LNsTISepH2xzZWWEIOrEzMoQYfUlYUdEqphwkLm8vbcNC0t5Bsf+ ATwdpIt+tzuAlPFqep2DXoPRA9j++chhJ13wCNl2nAhmOv0aiZTw7vMGug1/fF67q7Cj yZUpEyM9Zds+SacSM6Eee6edpN0Cm8z60y8l0=
MIME-Version: 1.0
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Date: Tue, 10 May 2011 15:48:21 +0900
Message-ID: <BANLkTikTbpAGgvyk8VJbhsmC0UuhyHG_DA@mail.gmail.com>
From: "KIHARA, Boku" <bkihara.l@gmail.com>
To: http-auth@ietf.org
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Subject: [http-auth] Fwd: [apps-discuss] HTTP MAC Authentication Scheme
Precedence: list

Maybe related to http-auth WG.

---------- Forwarded message ----------
From: Eran Hammer-Lahav <eran@hueniverse.com>
Date: 2011/5/10
Subject: [apps-discuss] HTTP MAC Authentication Scheme
To: "apps-discuss@ietf.org" <apps-discuss@ietf.org>
Cc: Ben Adida <ben@adida.net>, "http-state@ietf.org"
<http-state@ietf.org>, OAuth WG <oauth@ietf.org>, "Adam Barth
(adam@adambarth.com)" <adam@adambarth.com>, HTTP Working Group
<ietf-http-wg@w3.org>

(Please discuss this draft on the Apps-Discuss <apps-discuss@ietf.org>
mailing list)

http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token

The draft includes:

* An HTTP authentication scheme using a MAC algorithm to authenticate
requests (via a pre-arranged MAC key).

* An extension to the Set-Cookie header, providing a method for
associating a MAC key with a session cookie.

* An OAuth 2.0 binding, providing a method of returning MAC
credentials as an access token.

Some background: OAuth 1.0 introduced an HTTP authentication scheme
using HMAC for authenticating an HTTP request with partial
cryptographic protection of the HTTP request (namely, the request URI,
host, and port). The OAuth 1.0 scheme was designed for
delegation-based use cases, but is widely “abused” for simple
client-server authentication (the poorly named ‘two-legged’ use case).
This functionality has been separated from OAuth 2.0 and has been
reintroduced as a standalone, generally applicable HTTP authentication
scheme called MAC.

Comments and feedback is greatly appreciated.

EHL

[http-auth] Fwd: [apps-discuss] HTTP MAC Authenti… KIHARA, Boku