- From: <internet-drafts@ietf.org>
- Date: Fri, 20 Oct 2023 16:35:49 -0700
- To: <i-d-announce@ietf.org>
- Cc: ietf-http-wg@w3.org
Internet-Draft draft-ietf-httpbis-unprompted-auth-05.txt is now available. It is a work item of the HTTP (HTTPBIS) WG of the IETF. Title: The Signature HTTP Authentication Scheme Authors: David Schinazi David M. Oliver Jonathan Hoyland Name: draft-ietf-httpbis-unprompted-auth-05.txt Pages: 14 Dates: 2023-10-20 Abstract: Existing HTTP authentication schemes are probeable in the sense that it is possible for an unauthenticated client to probe whether an origin serves resources that require authentication. It is possible for an origin to hide the fact that it requires authentication by not generating Unauthorized status codes, however that only works with non-cryptographic authentication schemes: cryptographic signatures require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication. This document proposes a new non-probeable cryptographic authentication scheme. The IETF datatracker status page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/ There is also an HTML version available at: https://www.ietf.org/archive/id/draft-ietf-httpbis-unprompted-auth-05.html A diff from the previous version is available at: https://author-tools.ietf.org/iddiff?url2=draft-ietf-httpbis-unprompted-auth-05 Internet-Drafts are also available by rsync at: rsync.ietf.org::internet-drafts
Received on Friday, 20 October 2023 23:35:57 UTC