[http-auth] Fwd: I-D Action: draft-ietf-httpauth-mutual-02.txt

Dear all in http-auth,

Thank you very much for recent comments, especially on
introduction of the password-strengthening features and
cryptographic exchanges (transaction verification).

I updated the mutual-auth draft to -02 revision,
including the following major changes:

 * Introduction of PKCS #5 PBKDF2 password-strengthening.
   We have received some more proposals on using more
   stronger functions which are not yet in the RFC series.
   If we will go for standardizing those algorithms as well,
   I really appreciate more discussions.

 * Changed the client-side behavior description in Section 9,
   reflecting the comments "too complex!".
   Now the description is more property or requirement based,
   and the big state-machine is now informative purpose only.

 * Note on the transaction verification in cryptographic exchanges
   is added to the companion "algo" draft.
   I hope this will clarify the things for cryptographers.

---------- Forwarded message ----------
From:  <internet-drafts@ietf.org>
Date: 2014-04-24 19:41 GMT+09:00
Subject: [http-auth] I-D Action: draft-ietf-httpauth-mutual-02.txt
To: i-d-announce@ietf.org
Cc: http-auth@ietf.org

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol
Authentication Working Group of the IETF.

        Title           : Mutual Authentication Protocol for HTTP
        Authors         : Yutaka Oiwa
                          Hajime Watanabe
                          Hiromitsu Takagi
                          Kaoru Maeda
                          Tatsuya Hayashi
                          Yuichi Ioku
        Filename        : draft-ietf-httpauth-mutual-02.txt
        Pages           : 52
        Date            : 2014-04-24

Abstract:
   This document specifies a mutual authentication method for the Hyper-
   text Transfer Protocol (HTTP).  This method provides a true mutual
   authentication between an HTTP client and an HTTP server using
   password-based authentication.  Unlike the Basic and Digest
   authentication methods, the Mutual authentication method specified in
   this document assures the user that the server truly knows the user's
   encrypted password.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-mutual-02

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <y.oiwa@aist.go.jp>, <yutaka@oiwa.jp>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]