Re: [http-auth] Terry Manderson's No Objection on draft-ietf-httpauth-mutual-10: (with COMMENT)

Yutaka OIWA <y.oiwa@aist.go.jp> Wed, 09 November 2016 06:11 UTC

To: Terry Manderson <terry.manderson@icann.org>, The IESG <iesg@ietf.org>
References: <147804465351.23964.4743241573285672461.idtracker@ietfa.amsl.com>
From: Yutaka OIWA <y.oiwa@aist.go.jp>
Message-ID: <8ee97cfb-1261-247b-24b3-e5f0d1396c42@aist.go.jp>
Date: Wed, 09 Nov 2016 15:11:12 +0900
User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0
MIME-Version: 1.0
In-Reply-To: <147804465351.23964.4743241573285672461.idtracker@ietfa.amsl.com>
Content-Type: text/plain; charset="iso-2022-jp"
Content-Transfer-Encoding: 7bit
Received-SPF: None (protection.outlook.com: aist.go.jp does not designate permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Nov 2016 06:11:14.2976 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSXPR01MB0583
Archived-At: <https://mailarchive.ietf.org/arch/msg/http-auth/g-KLhukJFHhXF0TGM-nvY2K_ins>
Cc: http-auth@ietf.org, draft-ietf-httpauth-mutual@ietf.org, httpauth-chairs@ietf.org
Subject: Re: [http-auth] Terry Manderson's No Objection on draft-ietf-httpauth-mutual-10: (with COMMENT)
X-BeenThere: http-auth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: HTTP authentication methods <http-auth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/http-auth>, <mailto:http-auth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/http-auth/>
List-Post: <mailto:http-auth@ietf.org>
List-Help: <mailto:http-auth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-auth>, <mailto:http-auth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Nov 2016 06:11:21 -0000

Dear Terry,

thank you for the detailed comment.

On 11/02/16 08:57, Terry Manderson wrote:

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks for writing a very detailed document. 
> 
> A few minor comments.
> 
> 1) Please review the introduction, there are several grammatical errors
> in there. Meaning still came through just fine, but they were a little
> distracting.

We try to improve it in the next draft.

> 2) The state machine diagram of the client is quite complex. A candidate
> for the new RFC format?

Maybe :-)  We have a vector-graphics version in our hand.
(former submitted PDF versions have included it.)

> 3) I agree with Alvaro's comment on the IPR. Thank you for making it
> royalty free, however not sure you need to add the text in the RFC.

Thank you.  We remove it.

> 4) This to me seems as it is essentially a shared secret construct, one
> sentence from RFC 2361 (security considerations) seems applicable here.
> "All the security in this system is provided by the secrecy of the
> private keying material." If this the case, please provide ample warning
> that (as one would expect) loss of the password from either the client or
> the server results in a complete compromise.

Situation is a bit more detailed (strong passwords are safe against
server-side compromise), and We'll add a new subsection in Security Consideration.

-- 
Yutaka OIWA, Ph.D.        Leader, Cyber Physical Architecture Research Group
                                   Information Technology Research Institute
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <y.oiwa@aist.go.jp>, <yutaka@oiwa.jp>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

[http-auth] Terry Manderson's No Objection on dra… Terry Manderson
Re: [http-auth] Terry Manderson's No Objection on… 大岩寛
Re: [http-auth] Terry Manderson's No Objection on… Yutaka OIWA