Subject: Re: [OAUTH-WG] HTTP Mutual-auth proposal status / HTTP AUTH meet-up in Anaheim?

From: Yutaka OIWA <[email-masked]>
Date: Tue, 29 Dec 2009 15:50:28 +0900

Dear Jeff,

[ Sorry again for one more cross-posting response for an important comment,
  And please edit the reply addresses whenever appropriate ]

(for people in OAuth ML: this is a reply to http://lists.w3.org/Archives/Public/ietf-http-wg/2009OctDec/0356.html)

=JeffH <[email-masked]> writes:

>Thanks for sending out this announcement regarding your on-going work. Having a 
>meetup of one form or another to discuss HTTP authentication will be useful.
>
> In regards of the working-group context though, I note that the feedback given 
> on your presentation at IETF-74 in SF was that it was likely that the 
> appropriate place to discuss this work would be the to-be-formed OAuth WG...
(cut)
> Indeed, the OAuth WG has now formed 
> <http://www.ietf.org/dyn/wg/charter/oauth-charter.html> and its charter has 
> this note down towards the end..
>
>  > The Working Group will also define a generally applicable
>  > HTTP authentication mechanism (i.e., browser-based "2-leg"
>  > scenerio).
>
>
> So I respectfully suggest re-sending your message to <[email-masked]> and 
> taking discussion there -- and for those interested folks to subscribe to 
> <[email-masked]>.

Thank you very much for the important comment.

Yes, we were once suggested at San Francisco that we will be better
redirected to OAuth WG, and I also attended for OAuth WG there.
However, after that I felt getting lost between two WGs, because most
of discussions in OAuth ML and WG meeting are focused on the OAuth
related protocol only.  Moreover, most of discussions on
HTTP authentications (except OAuth) were still going on in httpbis ML.

I wanted to talk people at IETF meetings for this, because I was not
sure whether the redirection was accepted by the OAuth WG.  But as
there were no OAuth/httpbis WGs at Stockholm, we couldn't plan going there.
Then I talked personally at Apparea meeting at Hiroshima in Japan
(where we can go there easily and inexpensively :-)) and there I have
been suggested to first introduce our proposal to apps-discuss ML.
Coincidently, there comes a new mailing list well-suited for
discussing a general HTTP security matters at a very good
opportunity.  These are the reasons why I sent the previous mail to these
two MLs.  I also included http and http-auth MLs to the Cc list, 
because I had sent our proposal previously to these, and because
I thought that there might be people interested in generic HTTP
authentication issues.

I am still feeling unclear whether there is a consensus in the
people's mind whether the scope of OAuth WG really includes "generic"
HTTP authentication issues "unrelated to OAuth", because all contents
in the WG charter (except one sentence Jeff has mentioned) seems to me
only considering OAuth-related things.  These are mostly unchanged
from an older charter draft which had stated "generic HTTP auth is out
of scope".
In other words, I did read that sentence in the charter as
"to define OAuth-based 2-leg auth scheme generally applicable to HTTP",
considering other parts of the charter and other resources.
That's why I have hesitated to break in on OAuth WG with our proposal
without prior consent, and I will be happy if there will be a clear
statement on that.

Anyway, I will now forward my previous mail to the IETF OAuth ML, which
should have been included in the CC list.  I'll keep reading any MLs
I have mentioned, including OAuth.

# Please forgive me of late mail replies, as I am almost being drowned
# to surging waves of English mails (especially in httpbis MLs)...

I will of course attend all HTTP-related WGs at Anaheim, and I'm
looking forward to talking to people there.

Thanks again,

-- 
Yutaka OIWA, Ph.D.                                       Research Scientist
                            Research Center for Information Security (RCIS)
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 29 Dec 2009 15:57:06 +0900

Dear all at OAuth mailing list,

As I have suggested in another mailing list (http://lists.w3.org/Archives/Public/ietf-http-wg/2009OctDec/0356.html), I will repost an introduction for our proposal on 
secure generic HTTP authentication and call-for-meet-up to the 
IETF OAuth WG mailing list.
(If you feel this as out-of-topic, please kindly read my previous mail
 for a background.)

I hope we can meet and discuss on our proposal and other HTTP
authentication related topics in Anaheim.

Have a good new year,

Subject: HTTP Mutual-auth proposal status / HTTP AUTH meet-up in Anaheim?
From: Yutaka OIWA <[email-masked]>
To: [email-masked], [email-masked]
Cc: [email-masked], [email-masked]
Date: Thu, 24 Dec 2009 20:28:46 +0900

Dear people on IETF apps-discuss/public-web-security mailing lists
and other related lists,

I would like to introduce our proposal on HTTP mutual authentication.

 (I directed the Reply-to: header to the newly-created
  public-web-security mailing list, but I also welcome private replies
  or those to other lists.)

Our proposal brings a strong, password-based mutual authentication
to the HTTP authentication protocol.
Our aims are to overcome several deficiencies (both for security and usability)
on current HTTP authentication mechanisms, and to replace weak form-based
authentication, which are used in most current Web apps, with 
stronger HTTP protocol-supported authentications.
We designed the protocol so that (a) it removes any threats related to
password/secret stealing like phishing or other attacks, (b) it will be
extremely easy-to-use, and (c) it can accept many Web applications
which were not well-supported with current HTTP authentication
architecture (in RFC 2617).
We believe that this is a correct direction for the future of 
the Web application authentication.

Our proposed draft spec is available from
   <http://tools.ietf.org/html/draft-oiwa-http-mutualauth-05>.
We put a preprint paper on our concept at ArXiv 
   <http://arxiv.org/abs/0911.5230>,
and a presentation in a past httpbis WG is also available from
   <http://tools.ietf.org/agenda/74/slides/httpbis-3.pdf>,
I appreciate your reading and comments on those documents.

Furthermore, we have published a running code of the protocol
implementation for Mozilla Firefox, available from
   <https://bugzilla.mozilla.org/show_bug.cgi?id=532127>.
A pre-compiled binary, server-side implementations and running demonstration
are available in our website
   <https://www.rcis.aist.go.jp/special/MutualAuth/index-en.html>.

I noticed that the registration for IETF 77 at Anaheim is now open.
I would like to have a meet-up of people related to general HTTP
authentication issues/proposals at Anaheim.
I have been told from Lisa that there will be several HTTP-related
WGs and BoFs expected in Anaheim, and I think there will be a good 
opportunity for us to meet up.  If you have any good ideas, please let me know.

Have nice holidays, register for IETF 77 and see you in Anaheim!