Subject: [IPP] RFC: HTTP Digest changes for RFC 2910bis

From: Michael Sweet <[email-masked]>
Date: Thu, 04 Aug 2016 08:57:41 -0400

All,

The last call and ballet comments are rolling in for RFC 2910bis and 2911bis; one issue has come up that I'd like some feedback on...

RFC 2910 made Digest REQUIRED for Clients and RECOMMENDED for Printers, and requires MD5 and MD5-sess support.

RFC 2910bis changed this to RECOMMENDED for both Clients and Printers based on our experience that Digest is not widely implemented.  However, we've kept the MD5 and MD5-sess requirements if a Client or Printer *does* support it.

This latter portion is being raised as an issue: RFC 7616 (the current HTTP Digest RFC) deprecates MD5 and MD5-sess and requires SHA256 instead (which did not exist in 2000 when RFC 2910 was published).  They don't like us still requiring MD5 support, and my proposed "require both MD5 and whatever is in RFC 7616" compromise wasn't acceptable.

What they want is for us to drop the MD5 requirement and note it, something like:

Note: The MD5 and MD5-sess algorithms were mandatory to implement in the original IPP/1.1: Encoding and Transport [RFC2910]. This requirement has been removed in this document since the algorithms are deprecated by the current Digest Authentication document.

I am inclined to make this change since we've already softened the conformance language because there is limited deployment of IPP implementations using HTTP Digest - this won't break existing implementations.

Comments?

_________________________________________________________
Michael Sweet, Senior Printing System Engineer

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: Ira McDonald <[email-masked]>
Date: Thu, 4 Aug 2016 11:32:23 -0400

Hi Mike,

I agree with your proposed response to the IETF folks.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Thu, Aug 4, 2016 at 8:57 AM, Michael Sweet <[email-masked]> wrote:

> All,
>
> The last call and ballet comments are rolling in for RFC 2910bis and
> 2911bis; one issue has come up that I'd like some feedback on...
>
> RFC 2910bis changed this to RECOMMENDED for both Clients and Printers
> based on our experience that Digest is not widely implemented.  However,
> we've kept the MD5 and MD5-sess requirements if a Client or Printer *does*
> support it.
>
> This latter portion is being raised as an issue: RFC 7616 (the current
> HTTP Digest RFC) deprecates MD5 and MD5-sess and requires SHA256 instead
> (which did not exist in 2000 when RFC 2910 was published).  They don't like
> us still requiring MD5 support, and my proposed "require both MD5 and
> whatever is in RFC 7616" compromise wasn't acceptable.
>
> Note: The MD5 and MD5-sess algorithms were mandatory to implement in the
> original IPP/1.1: Encoding and Transport [RFC2910]. This requirement has
> been removed in this document since the algorithms are deprecated by the
> current Digest Authentication document.
>
>
> I am inclined to make this change since we've already softened the
> conformance language because there is limited deployment of IPP
> implementations using HTTP Digest - this won't break existing
> implementations.
>
> Comments?
>

---

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Thu, 4 Aug 2016 15:52:10 +0000

Hi Mike,

I don't object to the change.

Smith

/**
    Smith Kennedy
    Wireless Architect - Client Software - IPG-PPS
    Standards - IEEE ISTO PWG / Bluetooth SIG / Wi-Fi Alliance / NFC Forum / USB IF
    Chair, IEEE ISTO Printer Working Group
    HP Inc.
*/

> On 2016-08-04, at 6:57 AM, Michael Sweet <[email-masked]> wrote:
> 
> All,
>

---

From: "Paul Tykodi" <[email-masked]>
Date: Thu, 4 Aug 2016 12:11:40 -0400

Hi Mike,

I agree with your proposed change.

Thanks.

Best Regards,

/Paul

--

Paul Tykodi
Principal Consultant
TCS - Tykodi Consulting Services LLC

Tel/Fax: 603-343-1820
Mobile:  603-866-0712
E-mail:   <mailto:[email-masked]> [email-masked]
WWW:   <http://www.tykodi.com/> http://www.tykodi.com

This e-mail reply and any attachments are confidential and may be
privileged.

If you are not the intended recipient, please notify Tykodi Consulting
Services LLC 

immediately by replying to this message and destroying all copies of this
message 

and any attachments. Thank you

From: ipp [mailto:[email-masked]] On Behalf Of Michael Sweet
Sent: Thursday, August 4, 2016 8:58 AM
To: ipp <[email-masked]>
Subject: [IPP] RFC: HTTP Digest changes for RFC 2910bis

All,

RFC 2910 made Digest REQUIRED for Clients and RECOMMENDED for Printers, and
requires MD5 and MD5-sess support.

RFC 2910bis changed this to RECOMMENDED for both Clients and Printers based
on our experience that Digest is not widely implemented.  However, we've
kept the MD5 and MD5-sess requirements if a Client or Printer *does* support
it.

This latter portion is being raised as an issue: RFC 7616 (the current HTTP
Digest RFC) deprecates MD5 and MD5-sess and requires SHA256 instead (which
did not exist in 2000 when RFC 2910 was published).  They don't like us
still requiring MD5 support, and my proposed "require both MD5 and whatever
is in RFC 7616" compromise wasn't acceptable.

What they want is for us to drop the MD5 requirement and note it, something
like:

Comments?

---

From: Michael Sweet <[email-masked]>
Date: Thu, 04 Aug 2016 12:40:24 -0400

Thanks, all!

> On Aug 4, 2016, at 12:11 PM, Paul Tykodi <[email-masked]> wrote:
> 
> Hi Mike,
>  
> E-mail:  [email-masked] <mailto:[email-masked]>
> WWW:  http://www.tykodi.com <http://www.tykodi.com/>
>  
> This e-mail reply and any attachments are confidential and may be privileged.
> If you are not the intended recipient, please notify Tykodi Consulting Services LLC 
> immediately by replying to this message and destroying all copies of this message