Subject: Re: [saag] W3C Identity paper on GSS-REST

From: Stefan Santesson <[email-masked]>
Date: Thu, 05 May 2011 15:42:37 +0200

Nico,

I find this document and proposal very interesting and I believe that it
would be very useful in the context of HTTP authentication.

I see many "home cooked" solutions for user authentication over http and
not all of them turned out to be as secure as intended, especially not in
the context of channel binding and resilience against MitM attacks. At the
same time, many of these non standard authentication techniques are driven
by different reasons and needs, requiring different solutions. A generic
model for GSS based authentication over HTTP could be very useful in many
of those cases and could help avoid security pitfalls.

/Stefan

On 11-04-28 3:05 AM, "Nico Williams" <[email-masked]> wrote:

>I wrote the attached paper in a hurry, as I hadn't realized the
>deadline was upon me.  Even so, I think it will be of interest to
>SAAGers.
>
>The abstract:
>
>  Applications often require context-specific authentication
>  decisions, particularly HTTP applications. TLS provides limited
>  authentication facilities, and only at the transport-layer, which
>  is often inconvenient.  GSS-REST is a method that obtains
>  pluggable application-layer authentication for HTTP-based
>  applications, using off-the-shelf authentication mechanisms and
>  without replacing TLS for transport protection. Additionally,
>  GSS-REST provides a method by which to get away from cookies.
>
>  GSS-REST, as its name indicates, consists of POSTing GSS-API
>  "security context tokens" to a resource in order to authenticate
>  the client user and the service and to exchange cryptographic key
>  material, the latter needed only optionally to strengthen cookies.
>
>  Additionally, we discus some aspects of identity selection UI
>  issues.
>
>Nico
>--
>_______________________________________________
>saag mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/saag

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 May 2011 09:27:39 -0500

Stefan,

Thanks for the feedback!

My goal in pushing the use of a framework is to make it easier to use
integrate application-layer authentication and identity into the
browser -- there's no way to do that with app "home grown"
authentication methods.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Fri, 27 May 2011 12:37:18 -0500

Slides for all presentations are here:

http://www.w3.org/2011/identity-ws/agenda.html

These presentations were meant to take 5 minutes each -- the slide
decks are correspondingly short.  SAAGers might want to read some, if
not all of the presentations.

Nico
--