[Ietf-http-auth] Fwd: Correction: RFC 4169 Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA) Version-2

This is informational, but we should take a close look anyway

Lisa

Begin forwarded message:

> From: rfc-editor@rfc-editor.org
> Date: November 4, 2005 5:53:22 PM PST
> To: ietf-announce@ietf.org
> Cc: rfc-editor@rfc-editor.org
> Subject: Correction: RFC 4169 Hypertext Transfer Protocol (HTTP) 
> Digest Authentication Using Authentication and Key Agreement (AKA) 
> Version-2
>
>
> A new Request for Comments is now available in online RFC libraries.
>
>
>         RFC 4169
>
>         Title:      Hypertext Transfer Protocol (HTTP) Digest
>                     Authentication Using Authentication and Key
>                     Agreement (AKA) Version-2
>         Author(s):  V. Torvinen, J. Arkko, M. Naslund
>         Status:     Informational
>         Date:       November 2005
>         Mailbox:    vesa.torvinen@turkuamk.fi,
>                     jari.arkko@ericsson.com, mats.naslund@ericsson.com
>         Pages:      13
>         Characters: 26429
>         Updates/Obsoletes/SeeAlso:    None
>
>         I-D Tag:    draft-torvinen-http-digest-aka-v2-02.txt
>
>         URL:        ftp://ftp.rfc-editor.org/in-notes/rfc4169.txt
>
>
> HTTP Digest, as specified in RFC 2617, is known to be vulnerable to
> man-in-the-middle attacks if the client fails to authenticate the
> server in TLS, or if the same passwords are used for authentication
> in some other context without TLS.  This is a general problem that
> exists not just with HTTP Digest, but also with other IETF protocols
> that use tunneled authentication.  This document specifies version 2
> of the HTTP Digest AKA algorithm (RFC 3310).  This algorithm can be
> implemented in a way that it is resistant to the man-in-the-middle
> attack.
>
> This memo provides information for the Internet community.  It does
> not specify an Internet standard of any kind.  Distribution of this
> memo is unlimited.
>
> This announcement is sent to the IETF list and the RFC-DIST list.
> Requests to be added to or deleted from the IETF distribution list
> should be sent to IETF-REQUEST@IETF.ORG.  Requests to be
> added to or deleted from the RFC-DIST distribution list should
> be sent to RFC-DIST-REQUEST@RFC-EDITOR.ORG.
>
> Details on obtaining RFCs via FTP or EMAIL may be obtained by sending
> an EMAIL message to rfc-info@RFC-EDITOR.ORG with the message body
> help: ways_to_get_rfcs.  For example:
>
>         To: rfc-info@RFC-EDITOR.ORG
>         Subject: getting rfcs
>
>         help: ways_to_get_rfcs
>
> Requests for special distribution should be addressed to either the
> author of the RFC in question, or to RFC-Manager@RFC-EDITOR.ORG.  
> Unless
> specifically noted otherwise on the RFC itself, all RFCs are for
> unlimited distribution.
>
> Submissions for Requests for Comments should be sent to
> RFC-EDITOR@RFC-EDITOR.ORG.  Please consult RFC 2223, Instructions to 
> RFC
> Authors, for further information.
>
>
> Joyce K. Reynolds and Sandy Ginoza
> USC/Information Sciences Institute
>
> ...
>
> Below is the data which will enable a MIME compliant Mail Reader
> implementation to automatically retrieve the ASCII version
> of the RFCs.
> Content-Type: text/plain
> Content-ID: <051104175223.RFC@RFC-EDITOR.ORG>
>
> _______________________________________________
> IETF-Announce mailing list
> IETF-Announce@ietf.org
> https://www1.ietf.org/mailman/listinfo/ietf-announce