Re: [http-auth] First draft of HTTP Signatures published

Yoav,

On 05/12/2013 04:37 AM, Yoav Nir wrote:
> Hi Manu
> 
> The HTTP-Auth working group is chartered to work on a very specific set of documents. OTOH, the WebSec working group is considering adopting a work item for session continuation. Session continuation is supposed to be a replacement for authorizing requests via session cookies. See the problem statement here:
> 
> http://tools.ietf.org/html/draft-williams-websec-session-continue-prob-00
> 
> If I understand correctly, your draft is aiming to solve that issue. So you might prefer to take your draft there.

Fair points. But I do think some discussion of the differences between
Manu's proposal and HOBA on this list might be beneficial before any
conclusion as to IETF WG venue etc are reached.

In  addition I think Manu regards his scheme as a primary user
authentication scheme and not as a session continuation scheme which
again argues for discussing it here.

The above discussion will be more useful when we've posted the rev
of HOBA, which will be in the next few days.

Cheers,
S. (as participant, of course;-)

> Yoav Nir (as co-chair of both groups)
> 
> On May 10, 2013, at 9:29 PM, Manu Sporny <msporny@digitalbazaar.com> wrote:
> 
>> The HTTP Signatures spec is a digital signature mechanism for the HTTP
>> protocol. It adds origin authentication, message integrity, and replay
>> resistance to HTTP requests. This is useful for any application that
>> currently depends on Basic, Digest, OAuth, or OAuth2 authentication when
>> performing RESTful HTTP calls.
>>
>> Basically, if a client needs to prove to a server that it sent an
>> HTTP-based message, it can digitally sign that message. This spec
>> defines exactly how that happens.
>>
>> This spec will be used by the Web Payments / PaySwarm / Web Keys work at
>> W3C. We're going to combine the public/private key-based signature
>> mechanism defined in HTTP Signatures with the public key infrastructure
>> system as defined in Web Keys to provide an easy way for nodes on the
>> Internet to verify their identity to other nodes on the Internet.
>>
>> The first draft of this spec was just published via the Internet
>> Engineering Task Force (IETF) earlier today:
>>
>> http://tools.ietf.org/html/draft-cavage-http-signatures-00
>>
>> You can also find a datetime-stamped version of the spec here:
>>
>> https://payswarm.com/specs/ED/http-signatures/2013-05-04/
>>
>> The latest version of the spec can be found on the PaySwarm specs page:
>>
>> https://payswarm.com/specs/
>>
>> -- manu
>>
>> -- 
>> Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
>> Founder/CEO - Digital Bazaar, Inc.
>> blog: Meritora - Web payments commercial launch
>> http://blog.meritora.com/launch/
>> _______________________________________________
>> http-auth mailing list
>> http-auth@ietf.org
>> https://www.ietf.org/mailman/listinfo/http-auth
>>
>> Email secured by Check Point
> 
> _______________________________________________
> http-auth mailing list
> http-auth@ietf.org
> https://www.ietf.org/mailman/listinfo/http-auth
> 
> 