Re: [http-auth] FW: New Version Notification for draft-woodworth-json-http-auth-00.txt

The "password" variant sends the same info as BASIC, just with a different syntax. It is hard to see the point. Surely a normal BASIC header could be passed to client-side scripting just as easily as a re-formatted version?

The "challenge" variant looks like it is trying to mimic the DIGEST scheme, with a different syntax, and with the crypto applied slightly differently. The crypto changes look more dangerous than helpful. DIGEST at least separated the concepts of a Hash from a MAC (Keyed Digest), even if the latter used the former in too simple a way. In DIGEST the password is hashed with the username and realm to form a secret key, but not in "challenge". A new spec today should use a proper MAC algorithm, such as HMAC.

Quirks from DIGEST seem to be repeated in "challenge", such as separate "nonce" and "opaque" members despite both being: chosen by the server; opaque to the client; hashed into the response; and returned to the server.

The highly recommended "nonce" construction looks poor. A 36-char random UUID just to provide uniqueness within the 10µs window of the time component (eg 1488442706.13154) is overkill. Hashing a concatenation of nonce parts and a secret is the sort of ad hoc crypto that should be avoided. Use a proper MAC algorithm instead.

JSON has arrays so why not use an array for the "algorithms" member, instead of a comma-separated string with a rule to ignore whitespace?

The mix of base64, lowercase-hex, and UUID encoding; plus commas, slashes, hyphens, and colons as separators is a bit messy.

Suggesting window.AuthHandler() as a place to host handlers (without specifying actual APIs) sounds like it will ruin this place for use once something interoperable is actually defined.

Your pretty JSON format with commas at the start of the next line (instead of the end of the previous line) is a cute convention.
      {
         "type"     : "password"
        ,"username" : "MyUser"
        ,"password" : "MyPassword"
      }

--
James Manger

-----Original Message-----
From: http-auth [mailto:http-auth-bounces@ietf.org] On Behalf Of Woodworth, John R
Sent: Friday, 3 March 2017 8:17 PM
To: http-auth@ietf.org
Cc: Ballew, Dean <Dean.Ballew@CenturyLink.com>
Subject: [http-auth] FW: New Version Notification for draft-woodworth-json-http-auth-00.txt

All,

I understand this is late to the party but was hoping some of you may have time to review our new draft.  We welcome any questions, comments and assistance from the group.

Thanks,
John
-----Original Message-----
From: internet-drafts@ietf.org [mailto:internet-drafts@ietf.org]

A new version of I-D, draft-woodworth-json-http-auth-00.txt
has been successfully submitted by John Woodworth and posted to the IETF repository.

Name:           draft-woodworth-json-http-auth
Revision:       00
Title:          HTTP Authentication - |JSON| Scheme
Document date:  2017-02-28
Group:          Individual Submission
Pages:          17
URL:            https://www.ietf.org/internet-drafts/draft-woodworth-json-http-auth-00.txt
Status:         https://datatracker.ietf.org/doc/draft-woodworth-json-http-auth/
Htmlized:       https://tools.ietf.org/html/draft-woodworth-json-http-auth-00

Abstract:
   The |JSON| authentication scheme provides a mechanism for exchanging
   authentication challenges and credentials as objects in the form of
   JavaScript Object Notation (JSON).  This scheme offers a secure
   mechanism of providing authenticated access to a set of protected
   HTTP resources which may be handled by scripting utility framework as
   in XMLHttpRequest calls (AJAX) or directly by the client's user
   agent.  This chaining feature is unique to this scheme.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

-- THESE ARE THE DROIDS TO WHOM I REFER:
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth