draft-ietf-httpbis-unprompted-auth-04.txt | draft-ietf-httpbis-unprompted-auth-latest.txt | |||
---|---|---|---|---|
HTTPBIS Working Group D. Schinazi | HTTPBIS Working Group D. Schinazi | |||
Internet-Draft Google LLC | Internet-Draft Google LLC | |||
Intended status: Standards Track D. Oliver | Intended status: Standards Track D. Oliver | |||
Expires: December 30, 2023 Guardian Project | Expires: March 6, 2024 Guardian Project | |||
J. Hoyland | J. Hoyland | |||
Cloudflare Inc. | Cloudflare Inc. | |||
June 28, 2023 | September 03, 2023 | |||
The Signature HTTP Authentication Scheme | The Signature HTTP Authentication Scheme | |||
draft-ietf-httpbis-unprompted-auth-04 | draft-ietf-httpbis-unprompted-auth-latest | |||
Abstract | Abstract | |||
Existing HTTP authentication schemes are probeable in the sense that | Existing HTTP authentication schemes are probeable in the sense that | |||
it is possible for an unauthenticated client to probe whether an | it is possible for an unauthenticated client to probe whether an | |||
origin serves resources that require authentication. It is possible | origin serves resources that require authentication. It is possible | |||
for an origin to hide the fact that it requires authentication by not | for an origin to hide the fact that it requires authentication by not | |||
generating Unauthorized status codes, however that only works with | generating Unauthorized status codes, however that only works with | |||
non-cryptographic authentication schemes: cryptographic signatures | non-cryptographic authentication schemes: cryptographic signatures | |||
require a fresh nonce to be signed, and there is no existing way for | require a fresh nonce to be signed, and there is no existing way for | |||
skipping to change at page 2, line 12 ¶ | skipping to change at page 2, line 12 ¶ | |||
Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
Drafts is at https://datatracker.ietf.org/drafts/current/. | Drafts is at https://datatracker.ietf.org/drafts/current/. | |||
Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
This Internet-Draft will expire on December 30, 2023. | This Internet-Draft will expire on March 6, 2024. | |||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2023 IETF Trust and the persons identified as the | Copyright (c) 2023 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
(https://trustee.ietf.org/license-info) in effect on the date of | (https://trustee.ietf.org/license-info) in effect on the date of | |||
publication of this document. Please review these documents | publication of this document. Please review these documents | |||
skipping to change at page 7, line 47 ¶ | skipping to change at page 7, line 47 ¶ | |||
the signature scheme used to compute the proof transmitted in the "p" | the signature scheme used to compute the proof transmitted in the "p" | |||
directive. Its value is an integer between 0 and 65535 inclusive | directive. Its value is an integer between 0 and 65535 inclusive | |||
from the IANA "TLS SignatureScheme" registry maintained at | from the IANA "TLS SignatureScheme" registry maintained at | |||
<<https://www.iana.org/assignments/tls-parameters/tls- | <<https://www.iana.org/assignments/tls-parameters/tls- | |||
parameters.xhtml#tls-signaturescheme>>. | parameters.xhtml#tls-signaturescheme>>. | |||
5.4. The v Parameter | 5.4. The v Parameter | |||
The REQUIRED "v" (verification) parameter is a byte sequence that | The REQUIRED "v" (verification) parameter is a byte sequence that | |||
specifies the verification that the user agent provides to attest to | specifies the verification that the user agent provides to attest to | |||
possessing the key exporter output. This avoids issues with | possessing the key exporter output (see Section 4.2 for details). | |||
signature schemes where certain keys can generate signatures that are | This avoids issues with signature schemes where certain keys can | |||
valid for multiple inputs (see [SEEMS-LEGIT]). | generate signatures that are valid for multiple inputs (see | |||
[SEEMS-LEGIT]). | ||||
6. Example | 6. Example | |||
For example, the key ID "basement" authenticating using Ed25519 | For example, the key ID "basement" authenticating using Ed25519 | |||
[ED25519] could produce the following header field: | [ED25519] could produce the following header field: | |||
NOTE: '\' line wrapping per RFC 8792 | NOTE: '\' line wrapping per RFC 8792 | |||
Authorization: Signature \ | Authorization: Signature \ | |||
k=":YmFzZW1lbnQ=:", \ | k=":YmFzZW1lbnQ=:", \ | |||
End of changes. 5 change blocks. | ||||
7 lines changed or deleted | 8 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ |