Subject: Re: [saag] On webauth and layering (Re: Reminder: Call for Proposals - HTTP/2.0 and HTTP)

From: Yutaka OIWA <[email-masked]>
Date: Mon, 2 Jul 2012 17:56:52 +0900

Dear Nico,

First to clarify, you seem to be misunderstanding my claim about
"unnaturality".  I've never said that your specific proposal is unnatural;
I just said that use of HTTP headers are natural for Mutual authentication
protocol, and that such "naturality" property depends on specific design
and use of each protocols, not a universal one.
It seem to me that it also holds for Alexey's SCRAM-SHA1 proposal.

2012/6/26 Nico Williams <[email-masked]>:
> On Fri, Jun 15, 2012 at 7:38 PM, Yutaka OIWA <[email-masked]> wrote:

> If you mean that application-layer authentication is unnatural on the
> wire then I disagree vehemently.  In fact, I think any HTTP-layer
> authentication scheme will be unnatural on the wire: HTTP is a
> one-round-trip, stateless protocol, but authentication protocols are
> mostly NOT one round-trip (or less).

For the first sentence, the answer is "NO" as I wrote above.
However, I disagree on the following sentences.
Both Mutual and SCRAM authentication schemes are
meeting "stateless" requirements of the HTTP
which is described in httpbis-p1, quoted below.

> HTTP is defined as a stateless protocol, meaning that each request message can be understood in isolation. [...] Hence, servers MUST NOT assume that two requests on the same connection are from the same user agent unless the connection is secured and specific to that agent.

HTTP's design criteria is that HTTP transport is completely
"stateless", meaning that each response is tied to a single request,
and each request can be "understood" without knowledge of the
previous requests on the same wire (or, lower-layer transports).
There are features on top of HTTP transport which can be called
somewhat "stateful", including Cookies, caches and authentications
(including Basic and Digest), all of which are carefully
designed to meet p1-criteria (i.e. by marking related
requests explicitly on the request headers and/or payloads).

Previously, there were badly designed multi-hop authentication
protocol breaking this criteria.  RFC 4559 (SPNEGO) is one of
such examples which is explicitly mentioned in the current httpbis-p1 draft.
I am agreeing with the writer of the httpbis-p1 (Julian?) that
the design taken by RFC 4559 is conflicting with the HTTP's base philosophy.

Mutual proposal is avoiding such shortcomings and designed under the
same principle as current Digest standard did (and as SCRAM-SHA1 seems to do).
Each request is clearly "isolated", and can be "understood" by servers
without any knowledge of previous requests.  The contents of each response,
and the result (or consequence) of each request may depend on
the state of server-side applications and software,
but importantly, this property is as same as other authentication protocols
including OAuth Bearer, OAuth MAC, and even your GSS-REST, too.
It does not violate HTTP's requirement in any way, as same as others.

In the Mutual protocol, the property is clearly shown in the Section 10;
you can see that server-side response is determined just as a function
of an input request, not depending directly on the previous "flow" of protocols.
It does not require, in any way, that such responses
are handled as a set of requests implicitly tied by underlying transports.

-- 
Yutaka OIWA, Ph.D.              Leader, Software Reliability Research Group
                             Research Institute for Secure Systems (RISEC)
   National Institute of Advanced Industrial Science and Technology (AIST)
                     Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]