Subject: RE: [dix] Review of draft-merrells-dix-00.txt

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 12 Feb 2006 17:27:59 -0800

SAML has a ticket format defined (the artifact). I did not take part in
that part of the design but it should probably be looked at as it may
solve the problems already.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Eric Rescorla
> Sent: Sunday, February 12, 2006 8:09 PM
> To: Digital Identity Exchange
> Subject: Re: [dix] Review of draft-merrells-dix-00.txt
> 
> Johannes Ernst <[email-masked]> writes:
> 
> >> Method of ticket validation ...
> >
> > Are you basically proposing a variation of OpenID 
> authentication, or 
> > do I misunderstand you?
> 
> I'm not proposing anything. There are a number of ways to do 
> the kind of ticket verification that a DIX-type system would need. 
> The digest exchange that DIX uses strikes me as one of the 
> least convenient.
> 
> 
> 
> _______________________________________________
> dix mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dix
> 
> 

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 13 Feb 2006 10:46:14 -0800

We should look at HTTP Digest as well.

HTTP Digest is an existing standard used for password authentication. It
was designed before the current level of understanding of MAC function
construction from a Digest. That said though the amount of data involved
means that the difference between the Digest scheme and HMAC is not
significant.  

> Behalf Of John Merrells
> Sent: Monday, February 13, 2006 1:34 PM
> On 11-Feb-06, at 3:17 PM, Eric Rescorla wrote:
> 
> > 	A suggested implementation of a signature function 
> would be to use
> > 	the SHA1 algorithm, which takes as input a digest of 
> the message and
> > 	a secret known only to the Homesite.
> >
> > 	Signature = T ( S + Digest )
> >
> > 	Where, Digest is message digest (defined above), S is 
> the Homesite
> > 	Secret, T is the signature generation function, and '+' 
> means string
> > 	concatentation.
> >
> > The technical term for a "signature" which can only be 
> verified by the 
> > holder of a symmetric secret is Message Authentication Code 
> (MAC) and 
> > there's a standard technique for performing MACs: HMAC (RFC 2104).
> 
> We looked at that... but decided what we were doing was 
> different in some way. I'll dig out my notes.
> 
> John
> 
> 
>