Re: [http-auth] First draft of HTTP Signatures published

[Yoav Nir <[e-mail]>]

Works for me, especially since WebSec is still a long way from deciding to work on session continuation/management.

Yoav

On May 12, 2013, at 4:22 PM, Stephen Farrell <[e-mail]> wrote:

> 
> Yoav,
> 
> On 05/12/2013 04:37 AM, Yoav Nir wrote:
>> Hi Manu
>> 
>> The HTTP-Auth working group is chartered to work on a very specific set of documents. OTOH, the WebSec working group is considering adopting a work item for session continuation. Session continuation is supposed to be a replacement for authorizing requests via session cookies. See the problem statement here:
>> 
>> http://tools.ietf.org/html/draft-williams-websec-session-continue-prob-00
>> 
>> If I understand correctly, your draft is aiming to solve that issue. So you might prefer to take your draft there.
> 
> Fair points. But I do think some discussion of the differences between
> Manu's proposal and HOBA on this list might be beneficial before any
> conclusion as to IETF WG venue etc are reached.
> 
> In  addition I think Manu regards his scheme as a primary user
> authentication scheme and not as a session continuation scheme which
> again argues for discussing it here.
> 
> The above discussion will be more useful when we've posted the rev
> of HOBA, which will be in the next few days.
> 
> Cheers,
> S. (as participant, of course;-)
> 
> 
> 
> 
> 
>> Yoav Nir (as co-chair of both groups)
>> 
>> On May 10, 2013, at 9:29 PM, Manu Sporny <[e-mail]> wrote:
>> 
>>> The HTTP Signatures spec is a digital signature mechanism for the HTTP
>>> protocol. It adds origin authentication, message integrity, and replay
>>> resistance to HTTP requests. This is useful for any application that
>>> currently depends on Basic, Digest, OAuth, or OAuth2 authentication when
>>> performing RESTful HTTP calls.
>>> 
>>> Basically, if a client needs to prove to a server that it sent an
>>> HTTP-based message, it can digitally sign that message. This spec
>>> defines exactly how that happens.
>>> 
>>> This spec will be used by the Web Payments / PaySwarm / Web Keys work at
>>> W3C. We're going to combine the public/private key-based signature
>>> mechanism defined in HTTP Signatures with the public key infrastructure
>>> system as defined in Web Keys to provide an easy way for nodes on the
>>> Internet to verify their identity to other nodes on the Internet.
>>> 
>>> The first draft of this spec was just published via the Internet
>>> Engineering Task Force (IETF) earlier today:
>>> 
>>> http://tools.ietf.org/html/draft-cavage-http-signatures-00
>>> 
>>> You can also find a datetime-stamped version of the spec here:
>>> 
>>> https://payswarm.com/specs/ED/http-signatures/2013-05-04/
>>> 
>>> The latest version of the spec can be found on the PaySwarm specs page:
>>> 
>>> https://payswarm.com/specs/
>>> 
>>> -- manu
>>> 
>>> -- 
>>> Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
>>> Founder/CEO - Digital Bazaar, Inc.
>>> blog: Meritora - Web payments commercial launch
>>> http://blog.meritora.com/launch/
>>> _______________________________________________
>>> http-auth mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/http-auth
>>> 
>>> Email secured by Check Point
>> 
>> _______________________________________________
>> http-auth mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/http-auth
>> 
>> 
> 
> Email secured by Check Point