Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP MAC Authentication Scheme
Nico Williams <nico@cryptonector.com> Tue, 07 June 2011 17:35 UTC
Return-Path: <nico@cryptonector.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E2D51F0C39; Tue, 7 Jun 2011 10:35:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BxdZ496aZXFB; Tue, 7 Jun 2011 10:35:54 -0700 (PDT)
Received: from homiemail-a28.g.dreamhost.com (caiajhbdccah.dreamhost.com [208.97.132.207]) by ietfa.amsl.com (Postfix) with ESMTP id 1B6481F0C36; Tue, 7 Jun 2011 10:35:54 -0700 (PDT)
Received: from homiemail-a28.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a28.g.dreamhost.com (Postfix) with ESMTP id C35D11B4078; Tue, 7 Jun 2011 10:35:53 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=cryptonector.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc :content-type:content-transfer-encoding; q=dns; s= cryptonector.com; b=w8IK2aGMWRP9XrsrgfCDepvGOFww6Y8qqUz9zVWp6f3M rryvqeEjSMsmkbkLFA1ty80S+oOFsZ6DWgKjlplQ+3cW/BMa0Gy7bgLrEulPkuqt V+9Smxm24Qu3/7jHi3M8CEIV2bofVEnulb4YmpT9qq7A4OvIY95tJVofpmFENMU=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type:content-transfer-encoding; s= cryptonector.com; bh=btKLDXJPPjTq3XZvKHfUdtb6H/A=; b=NzPxHv8LHsd 6CJrUKAMDSHIJIQ9+86/zXngVBVfNmvh/tc++dv2TfUgZAWFYJ6huSam02gQzzAQ 0JBS51TterCU1Rxn0M1Ahr6AVasLptnQ8rH/ixjkAMPWHgPPyieel25RvfnORUlj wtPVAov7F+9/wZXT5EFWuLt575INmwXw=
Received: from mail-pz0-f44.google.com (mail-pz0-f44.google.com [209.85.210.44]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a28.g.dreamhost.com (Postfix) with ESMTPSA id 96C8C1B406F; Tue, 7 Jun 2011 10:35:53 -0700 (PDT)
Received: by pzk5 with SMTP id 5so2920439pzk.31 for <multiple recipients>; Tue, 07 Jun 2011 10:35:53 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.37.3 with SMTP id u3mr295077pbj.456.1307468153080; Tue, 07 Jun 2011 10:35:53 -0700 (PDT)
Received: by 10.68.50.39 with HTTP; Tue, 7 Jun 2011 10:35:52 -0700 (PDT)
In-Reply-To: <09c801cc24c2$a05bae00$e1130a00$@packetizer.com>
References: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET> <BANLkTikpQNyQdr9oWHhtJ7a7d-4ri0CNdA@mail.gmail.com> <09c801cc24c2$a05bae00$e1130a00$@packetizer.com>
Date: Tue, 07 Jun 2011 12:35:52 -0500
Message-ID: <BANLkTin30NVzYVV1m4gmyh42DWs-nSQpAg@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: "Paul E. Jones" <paulej@packetizer.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: apps-discuss@ietf.org, Ben Adida <ben@adida.net>, Adam Barth <adam@adambarth.com>, http-state@ietf.org, HTTP Working Group <ietf-http-wg@w3.org>, OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP MAC Authentication Scheme
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Jun 2011 17:35:55 -0000
On Mon, Jun 6, 2011 at 10:25 PM, Paul E. Jones <paulej@packetizer.com> wrote: > Nico, > > Sorry for coming into this so late, but I just saw this message. > > I don't have all of the background, but when I saw this message header and > some of the dialog, it seems there is a desire to provide some level of > authentication to requests and/or responses between the clients and servers. > > Gonzalo and I worked on this: > https://tools.ietf.org/html/draft-salgueiro-secure-state-management-04 > > This may not be entirely complete, but the idea was to allow a client and > server to establish an association so that requests and responses could be > authenticated. Is this something along the lines of what you are > discussing, or is this an entirely different application? I'm completely on-board with session state[*]. My comments were particularly in regards to threat models. I believe that eavesdroppers and active attackers both need to be considered, particularly as we have so many open wifi networks. To me the simplest way to address the Internet threat model is to always use TLS (except, maybe, for images and such elements that have little or no security value, though one must be careful when making that determination) and to use channel binding. See the I-D referenced below. [*] See, for example: http://www.ietf.org/id/draft-williams-rest-gss-00.txt Nico --
- [OAUTH-WG] HTTP MAC Authentication Scheme Eran Hammer-Lahav
- Re: [OAUTH-WG] HTTP MAC Authentication Scheme Justin Richer
- Re: [OAUTH-WG] HTTP MAC Authentication Scheme Peter Wolanin
- Re: [OAUTH-WG] HTTP MAC Authentication Scheme Justin Richer
- Re: [OAUTH-WG] HTTP MAC Authentication Scheme Eran Hammer-Lahav
- Re: [OAUTH-WG] HTTP MAC Authentication Scheme Adam Barth
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Nico Williams
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Eran Hammer-Lahav
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Nico Williams
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Mark Nottingham
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Stephen Farrell
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Eran Hammer-Lahav
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Mark Nottingham
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Adam Barth
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Eran Hammer-Lahav
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Dave CROCKER
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Mark Nottingham
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Stephen Farrell
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Adam Barth
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Igor Faynberg
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Adam Barth
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… William J. Mills
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Tim
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… William J. Mills
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [apps-discuss] [http-state] HTTP M… Mark Nottingham
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Randy Fischer
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Tim
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Eran Hammer-Lahav
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [apps-discuss] [http-state] HTTP M… Breno de Medeiros
- Re: [OAUTH-WG] [apps-discuss] [http-state] HTTP M… Nico Williams
- Re: [OAUTH-WG] [apps-discuss] [http-state] HTTP M… Bjartur Thorlacius
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Robert Sayre
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Tim
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Tim
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Adam Barth
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Nico Williams
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Paul E. Jones
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Eran Hammer-Lahav
- Re: [OAUTH-WG] [http-state] [apps-discuss] HTTP M… Tim
- Re: [OAUTH-WG] [apps-discuss] [http-state] HTTP M… Bjartur Thorlacius
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Eran Hammer-Lahav
- Re: [OAUTH-WG] [apps-discuss] HTTP MAC Authentica… Mark Nottingham