Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Hiya,

On 06/01/15 14:05, Barry Leiba wrote:
>>> This document would benefit from some section somewhere giving a
>>> set of clear, numbered steps, saying who sends, who receives, and
>>> who does what with what input at each step.  I will propose such
>>> text.
>> 
>> And I'll happily look at that when it's available. (And hope to not
>> have to wait much:-)
> 
> And here we go; 

Thanks for being timely.

> not a lot, but I think it really helps.  Of course,
> adjust it if I got anything wrong or worded inaccurately.  Note how
> the section references jump around -- that's why I found it hard to
> follow, and why I think this is a big help.  I'm suggesting making
> this Section 1.3 because I think having it up front makes it the most
> useful.

Yeah, TBH I think that's superflous but harmless and doesn't
replicate text already elsewhere so I've put it in (same [1,2]
as before work) almost as-is.

Cheers,
S.

[1] https://down.dsg.cs.tcd.ie/misc/draft-ietf-httpauth-hoba-10.txt
[2]
https://tools.ietf.org/rfcdiff?url1=draft-ietf-httpauth-hoba-09.txt&url2=https://down.dsg.cs.tcd.ie/misc/draft-ietf-httpauth-hoba-10.txt

> 
> ------------------------------------- 1.3 An Overview of HOBA-http
> Authentication
> 
> HOBA authentication uses the HTTP authentication framework defined in
>  [RFC7235], using a number of HOBA-specific elements.  This is a
> high-level overview of HOBA-http authentication:
> 
> 1. If the user is not already registered with the web-origin and
> realm it is trying to access, the "joining" process is invoked (see
> Section 6.1).  This creates a key pair and makes the CPK known to the
> server.
> 
> 2. The client connects to the server and makes a request, and the
> server's response includes a WWW-Authenticate header field that
> contains the "HOBA" auth-scheme, along with associated parameters
> (see Section 3).
> 
> 3. The client uses the challenge from the HOBA auth-scheme
> parameters, along with other information it knows about the
> web-origin and realm, to create and sign a HOBA-TBS string (see
> Section 2).
> 
> 4. The client creates a HOBA client-result (HOBA-RES), using the
> signed HOBA-TBS for the "sig" value (see Section 2).
> 
> 5. The client includes the Authorization header field in its next
> request, using the "HOBA" auth-scheme and putting the HOBA
> client-result in an auth-param named "result" (see Section 3).
> 
> 6. The server authenticates the HOBA client-result (see Section
> 5.3).
> 
> 7. Typically, the server's response includes a session cookie that
> allows the client to indicate its authentication state in future
> requests (see Section 1.1).
> 
> [You might include an example here, as Julian suggests.  Or perhaps
> you might put an example in an appendix, and just cite it here.]
> 
> -------------------------------------
> 
> Please let me know what you think.
> 
> Barry
>