Subject: [OAUTH-WG] Fwd: [http-auth] Review Request for third draft of "Signing HTTP Messages"

From: Phil Hunt <[email-masked]>
Date: Thu, 8 May 2014 16:22:16 -0700

How does this compare with justin's draft?

Phil

Begin forwarded message:

> From: Manu Sporny <[email-masked]>
> Date: May 8, 2014 at 14:41:55 PDT
> To: IETF HTTP Auth <[email-masked]>
> Cc: Julian Reschke <[email-masked]>, Mark Nottingham <[email-masked]>, Web Payments CG <[email-masked]>
> Subject: [http-auth] Review Request for third draft of "Signing HTTP Messages"
> 
> After feedback from Mark Nottingham[1], Julian Reschke[2], folks in the
> HTTP Auth WG, and people in the Web Payments CG, we've modified the HTTP
> Signatures specification in the following ways:
> 
> 1. The specification has been renamed to "Signing HTTP Messages".
> 2. The specification now covers both a signature-based Authorization
>   mechanism (client-to-server) as well as a general mechanism to sign
>   HTTP messages (client-to-server and server-to-client).
> 3. A new "Signature" header has been introduced.
> 4. The layout has been modified heavily to streamline the information
>   conveyed in the spec.
> 5. New registries have been created for the algorithms referred to in
>   the specification.
> 6. We're now more specific in the way certain canonicalizations are
>   performed.
> 7. More examples have been added, including how to digitally sign
>   the body of an HTTP message.
> 
> The basic mechanism of generating the signatures has not changed (and
> has been stable for over a year).
> 
> The newest spec can be found here:
> 
> http://tools.ietf.org/html/draft-cavage-http-signatures-02
> 
> The diff is here:
> 
> http://tools.ietf.org/rfcdiff?url2=draft-cavage-http-signatures-02.txt
> 
> Matt, Yoav, Kathleen, if there are no show stopping review comments, I'd
> like to push this spec onto the RFC track in the HTTP Auth WG, or
> HTTPbis/2 WG. It'll be ready for a LC in a month or two. I realize that
> HTTP Auth may be shutting down next month, so what's the next step to
> get the HTTP Signatures spec further down the IETF RFC track?
> 
> -- manu
> 
> [1] http://lists.w3.org/Archives/Public/public-webpayments/2014Feb/0038.html
> [2] http://lists.w3.org/Archives/Public/public-webpayments/2014Feb/0036.html
> 
> -- 
> Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
> Founder/CEO - Digital Bazaar, Inc.
> blog: The Marathonic Dawn of Web Payments
> http://manu.sporny.org/2014/dawn-of-web-payments/
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 12 May 2014 19:59:21 +0200

Conceptually, draft-cavage-http-signatures-02 is the same as OAuth 1.0.
Therefore, the symmetric key part of the document is the same as the MAC
token.

Not quite sure why the authors have not read the OAuth work.

On 05/09/2014 01:22 AM, Phil Hunt wrote:
>> *From:* Manu Sporny <[email-masked]
>> <mailto:[email-masked]>>
>> *Date:* May 8, 2014 at 14:41:55 PDT
>> *To:* IETF HTTP Auth <[email-masked] <mailto:[email-masked]>>
>> *Cc:* Julian Reschke <[email-masked]
>> <mailto:[email-masked]>>, Mark Nottingham <[email-masked]
>> <mailto:[email-masked]>>, Web Payments CG <[email-masked]
>> <mailto:[email-masked]>>
>> *Subject:* *[http-auth] Review Request for third draft of "Signing
>> HTTP Messages"*
>>
>> [1]
>> http://lists.w3.org/Archives/Public/public-webpayments/2014Feb/0038.html
>> [2]
>> http://lists.w3.org/Archives/Public/public-webpayments/2014Feb/0036.html
>>
>> -- 
>> [email-masked] <mailto:[email-masked]>
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Justin Richer <[email-masked]>
Date: Tue, 13 May 2014 11:32:53 -0400

They’re similar in that they both take elements from the HTTP message and create a signature on them, and they use the same “list the order of the elements” trick to avoid normalization to a large extent. The main difference is that my draft uses JWS as the signature (and ultimately transport) mechanism and the Cavage draft (and the AWS method it is born from, as I understand it) uses a new HTTP auth header format, much like OAuth 1.0 and the (old, dusty, abandoned, can-we-stop-bringing-it-up) MAC draft. My original (unpublished) version of the draft didn’t actually specify or care how you got the key, as I think that HTTP signing is a general mechanism.

That said, there seems to be a lot of interest in solving this case that OAuth 1.0 managed to get somewhat right-ish.

 — Justin

---

From: Bill Mills <[email-masked]>
Date: Tue, 13 May 2014 08:50:07 -0700 (PDT)

I do look at some of the stuff we're doing and thing "Is that all gonna fit in one header line?".   Breaking some of this out into a new header field is reasonable but doesn't feel as clean as having it all in one place.

On Tuesday, May 13, 2014 8:33 AM, Justin Richer <[email-masked]> wrote:

— Justin