I-D Action: draft-ietf-httpbis-unprompted-auth-00.txt

[[e-mail]]

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This Internet-Draft is a work item of the HTTP WG of the IETF.

        Title           : HTTP Unprompted Authentication
        Authors         : David Schinazi
                          David M. Oliver
                          Jonathan Hoyland
  Filename        : draft-ietf-httpbis-unprompted-auth-00.txt
  Pages           : 9
  Date            : 2023-02-24

Abstract:
   Existing HTTP authentication mechanisms are probeable in the sense
   that it is possible for an unauthenticated client to probe whether an
   origin serves resources that require authentication.  It is possible
   for an origin to hide the fact that it requires authentication by not
   generating Unauthorized status codes, however that only works with
   non-cryptographic authentication schemes: cryptographic schemes (such
   as signatures or message authentication codes) require a fresh nonce
   to be signed, and there is no existing way for the origin to share
   such a nonce without exposing the fact that it serves resources that
   require authentication.  This document proposes a new non-probeable
   cryptographic authentication scheme.


The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-httpbis-unprompted-auth-00.html


Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts