Re: [http-auth] [saag] [websec] re-call for IETF http-auth BoF

[Yutaka OIWA <[e-mail]>]

2011/6/15 Nico Williams <[e-mail]>:
> On Mon, Jun 13, 2011 at 11:59 PM, Peter Gutmann
> <[e-mail]> wrote:
>> Phillip Hallam-Baker <[e-mail]> writes:
>>>what would we want HTTP authentication to look like?
>>
>> I have a suggestion for what it shouldn't look like: Any method that hands
>> over the password (or a password-equivalent like a password in hashed form) as
>> current browsers do should be banned outright, and anyone who implements
>> hand-over-the-password should killed and eaten to prevent them from passing on
>> the genes.
>
> +1.

+1, although the original statement is a bit too strong in wording for me :-)

>  - Is this to be done in TLS?  HTTP?  Or at the application-layer?
>
> IMO: TLS is too low a layer to do authentication in, and doing it in
> HTTP would require retrofitting too many HTTP stacks.  Doing it at the
> application layer has a number of advantages.

IMO, I agree that TLS is too low.
However, although the application layer use-case exists,
I believe that for general use cases HTTP-auth layer is more appropriate,
because the trust relationship becomes much simpler.

Backward-compatibility is important, and all intermediates *should* and
*in most cases will* work well with new http authentication
that completely complies with existing HTTP auth framework design.
All they've needed is just forward auth-related headers to the origin server.
We've done some experiment around my proposal,
and it worked quite well with all existing stacks,
including proxies, "SSL accelerators" and load balancers.
(Yes, we've carefully designed the protocol so that it can work in this way.)
Do you need some more detail on it?

Required code modification is almost the same magnitude in both cases,
because we need to change the client, and to add some server-side thing.
we can keep all other intermediates as it is.
Some client-side change is necessary in both cases to make mutual
authentication trustful and unforgeable.
In server-side, http-layer authentication can be implemented in either
in the server or in the application.