Re: [secdir] secdir review of draft-ietf-httpbis-auth-info-04

[Julian Reschke <[e-mail]>]

On 2015-04-06 22:35, Catherine Meadows wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
>
> This draft defines the “Authentication-Info” and
> “Proxy-Authentication-Info” response header fields for use in HTTP
> authentication.
> These are used for schemes that need to return information once a
> client’s authentication credentials have been accepted.
> The document defines the syntax, and gives instructions on how it should
> be treated (e.g. proxies forwarding a response are
> not allowed to modify it).  The actual semantics of the fields depend
> upon the protocols that use them.
>
> In the Security Considerations section, the authors note that adding
> information to HTTP responses sent across an unencrypted
> channel can affect security and privacy.  Indeed the presence of these
> header fields alone indicate that HTTP authentication is in use.
>   Additional information
> could be exposed depending on the authentication scheme; but this is
> something that will need to be addressed in the definition of the schemes.
>
> I only have one small question about the Security Considerations
> section: wouldn’t there be other headers that indicate authentication is
> being used, such
> as a header indicating that a message contains the client’s credentials?
>   If so, I don’t see how the introduction of an additional header field
> adds any further risk.
> ...

Other header fields might indeed be present, but not necessarily on the 
HTTP *response*.

> I believe that this ID is ready with nits.
>
> Cathy

Best regards, Julian