Internet Engineering Task Force 93, 20 Jul 2015

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF93-HTTPAUTH-20150720-1740

Description

HTTPAUTH meeting session at IETF93
2015/07/20 1740

A

B

That's better hi welcome to the HTTP authentication working group making it's just everyone come to this side of the room because we're simply not there and there's plenty of plenty of seats on this side.

C

B

Start the blue sheets going.

B

If you've ever been to an ITF meeting before you might have seen this at some point on, this is the largest font I could manager and look at the fair, legible, at least from this distance.

B

So we have a short meeting today, just one hour, so the blue sheets are already circulating. Make sure you sign up you seen the note. Well, scribes is your own in here Oh kind of volunteered to be to take notes of anyone else can take notes on.

B

Okay, so we'll hope he gets here by the time we finished with the administrative stuff.

B

How about the jabber scribe, anyone in the Java room, ah here's your own! Thank you for volunteering to take notes.

B

Okay, so we need somebody in the jabber room. I, don't think we have any remote participants that we know about, but there could be some that we don't know about. Ok, we're going to document status. Then we're going to see a presentation about our current working group document, which is crammed and then we're going to see a couple of presentations about proposed items for this working you and if you have time open mic. So as I said, blue seats no clone squad. Oh so anybody in the driver room. Anyone at all come on people CZ.

B

Fine, we have to start naming names.

D

B

You people are so afraid they don't even have their laptops open. If you see anybody with a laptop, then I say you know.

B

Okay, well see how that goes.

B

The case of the missing chair, as you can see, I'm alone here, and the reason for that is that Matt Lapinskas accepted the new job, as he has a teaching position in some colleges, just starting a computer science program. So good luck to Matt and right now we if anyone a few is, has some experience with the idea, no need for a lot and is somewhat knowledgeable about HTTP. Http authentication is willing to do it and is not a current working group document.

B

Author I welcome to come talk to me or to Kathleen, and we are looking for a new chair, hey or something else that we'll talk about in email.

B

Document status, so basic and digest are now in the RFC eddakath you both are pretty much done there at the top of the queue except they're, both waiting for the pricey documents to be finished, after that it's just our 48 and they get published so scram hasn't seen much discussion on the list and we're hoping to change that today, which leaves us with nice piece going backwards.

B

Mutual off we've had no progress, despite a lot of goodwill at the meeting last time, so we're going to try a new plan. The other is going to prepare an issue list. They already started so we'll post two to three issues at a time to the mailing list- and this is something that's already worked in another working group. What we're going to do is say: okay, this is an issue.

B

We propose to close it by making this change or disclosing it, not making any change, and if anybody feels that this is not the wrong conclusion to this problem then speak up now because we're going to close the issue in two weeks, then, if nobody speaks, we closed the issue in two weeks as well as proposed. If, during the discussion, some other issue comes up, we add that to the list and when the list goes down to zero, we go to working group last call. Yes, let's see.

C

Question I'm going to use track or something um it would be useful to have a list of all issues, including the one pitch at lost in case they need to be open in general. Just on one place, we.

B

Can use track or we can use the github. The documents are now on github, so both.

A

C

B

C

Responses for we can use track or what you use github, because document just got published on github today. So yeah.

B

So either way as long as it's successful yeah and although this slide says that it's the document Arthur's doing it and I, don't think that's really the best idea. If we don't get a second chair, we can get somebody to be a working up secretary and do this on the list thing. That's great experience for somebody who hasn't been a chair before and well.

B

If you don't want to propose yourself as a working wheel chair, what we want secretary is also a great option, so talk to me and if you want to talk to, if you want to be a chair, dr. Kathleen as well, but you came back to me so people comfortable with this process thing good.

B

So try that, because otherwise we really can't make progress, and this is too big a document to go the individual routing. This is not something that I would feel comfortable if it was 80 sponsored okay, not that they have much to say about it.

D

And for some reason.

B

Oh, that's less slide because an hour you have slides for the other presentation, so Alexi.

B

You don't have to stand in the pink box. Yes, you should.

C

Right so last time we talked about this document was in Hawaii I. Think I did two updates to revisions next slide, so 11 big discussion. How I was about.

C

Initially, the HTTP scram was slightly different from sasal scram, so you couldn't quite reuse the libraries disease. So now there is an extra base, 64 encoding or scram data, but then you can use existing social libraries just just to give this information and poly HTTP specifics parameters are represented as HTTP directives for ww authenticator authorization directive.

C

The other changes I've changed too sharp 256, as mandatory to implement sharen, is still there for most of a backward compatibility with scram SAS, also just registering both of these um maybe never got updated and the world various fix-ups to the syndication mode. I initially sort of sketched how it's going to look like and then, when I thought about it, there was a missing bed so clarify, though,.

B

So, regarding yeah younger, so regarding that sha1 is still there and steven is not here, because that fab is making in the other room. But do you think this is going to generate a discuss? Haven't shy one this day and age, I.

C

Don't have strong feelings about this, however, one of the reasons for having this is so that you can, you know, share library, so existing libraries, mostly support, shall run. On the other hand, you know one implementation I did is he is written using openssl, so changing hash is very easy, so I'm.

C

If people want me to take it out, it's fine for now I, just I, don't think it's something rage now.

D

Is there a reason to keep it because I'm not hearing is good enough. One and I agree with yo ass it'll- be a lot easier to just.

C

C

Maybe bit speculative so let's say: I have a I'm absorber and call that server package together, calendaring and mail, and they use the same underlying library underneath they then they run, can implement. Http scrams are the one will implement regular scram scram shall run but I suppose might not be good enough reason not to not to not oh great. So this.

D

Is chris given at the other microphone hi Chris yeah? If I could respond to that again, their life go on yeah, so I was going to say the I think the real advantage to using the scroll scram is it has a um a the server-side hash that now has two functions. Not only does it off escape password, but it also allows a non play text authentication where you're not reusing your password on all servers. You know where you don't have that weakness, so you know most sites.

D

If you just do password base they're just going to go there going to do some random hash that doesn't have any authentication protocol, you can use that same hash with that's better than play. Jacks I.

C

Think you are uncertain thrown question. The question is was currently the document document both crush 1 and scrum sha-256 people asked him to take, shall run out. I have no objection to taking shower out. Well, he is one of the courses or on scram, so I think that that's fine yeah.

D

B

C

The most list of open issues there are really only three things and I think on one of them. I'll just do nothing on the other. Two is.

C

Let's start with the easy one um I'm sorry I think this must have been might have been discussed in Hawaii on in Honolulu, but I don't remember dancer with the authentication mode. Digest has tail directed that signals the client that the nonsense tail, so you have to redo the full handshake.

C

Do we need something like this here? ah I think people might have said yes, but I don't remember, I couldn't quite find out what was the outcome of this discussion.

E

I'm utakata so I think the answer should be yes, but I'm, not incrementing. So you need to distinguish whether the person he sure has been paid adjust. The key must be renewed. So if the school ama do not have that function inside the answers- maybe yes yeah the.

C

Difference without this, the directive, when the server responds you know now, you need to do for handshake. The client doesn't know what it needs to proper dialogue and say try new password or where they should just return I with the new nonce. So probably a good idea to add this. The other thing is username password, canonicalization I think we're discussing of referencing social prep. This document and it's finally I- was updating slides. You know it was a sufferer business, Russian, 6 and now it's 18. So there were quite a lot of changes.

C

So I think I will do these changes and the rest is mostly editorial. Just proofreading and.

C

Can you switch to the next slide?

C

Yes, that switch the next slide right, so proofread try to implement the authentication mode.

C

Also, I think tone implemented the sha-256 version. Yes, so I will ask you to do new examples of help me with examples that would be maybe.

C

That's actually.

B

Okay, so do you think this could be up for working group last call before Yokohama yeah.

F

B

Give us a steady pace of one hour of sleep per.

E

Meeting all right, what do you mean by implement? You mean you want you, you, you need some help to check. Please I two acts in the eyes up there. It was.

C

So for the two round-trip, the regular mode is already implemented and another implementation. Some I am relatively happy that this the way it's described is correct for your authentication mode. I want to make sure that it's correct and implementable that it's not missing any details which are in my head for so.

D

Tony Hanson in the current draft you have in your examples, you're using 'too data equals and then you say base64 of yes, whatever are those placeholders for yes, okay, so yeah! My wreck. My suggestion is that you actually put basic the basics before there and have a comment. Yes saying: um that's the I.

C

Didn't want to leave just basic c4 there because it needs to be by 64 valid protocol anyway. So because I will ask you to generate new examples, then I. Can you know if you just do the correct one and then I can also add a comment saying and if you base64 decode, that this is what it looks like, so that people can verify internal state states and stuff. So, oh.

D

So we're on the same page.

D

B

Let me get the next thing, that's the one.

B

Up costs money wanted.

B

B

Never use a better version of microsoft office. Okay,.

D

F

Slightly okay, so, during that very you've that HTTP they just draft and that's a gifted, Directorate and and the general to you- is suggested subway, adding support for H Mac a, and they also that stunned a steam and suggested adding a salted hash 2 to the M. Ok, today it digests, so this proposal is just to discuss those two two issues here. Next. Why? Please so currently in the digest mechanism, a difference, two functions: one is H, which is just a hash, simple hash. Another is a derived key or a or key a key keed.

F

I keed digest, so that key digest is supposed to be a kid mechanism, but in reality, what happens right now is that it's just a hash of that concatenation of the secret and the data with that new mechanism. If we support, if we add a h mac support, it would become a real, a kid digest, and the second part is adding that salt to that to the value we we calculate, which is a one right.

F

So these are the proposed changes to a to the existing functions, to allow us to support those h mac and a and the salt XY. Please so for to do that. We need to act a to prime or we need to add. One parameter, which is assault in this case, is going to be returned in the challenge, but from the server to the client for the client to do the right calculations and we need to update them in the hash algorithms to to a add support for each match. Key algorithms.

F

Next, no, please and examples here so a a one will they will include that the salt ha1, for example, will have they use a short of 56 as an example and a response will they will be a kid digest, so h-here one will be that the key and the rest will be just the message and so that that's just a simple example of the change that they were proposing here and.

D

That's about it, I think right.

F

Yeah, so that's that's the proposal. Any comments suggesting I know that there was is a some support for this work here on the mailing list and any any comments. I'd.

B

Like to stress first, this is a knot or not a current working with document. We, those on document yet.

F

D

B

The man thing so we're trying to discuss it here, we've allocated about 10 minutes for this and it's fine. We can overflow because Alexei kept it brief, but the work because yet to decide whether it wants to accept it, and we still have a lot of other work to do before you got new stuff. Having said that, I think the obvious question was this changes the crypto. Has anybody looked at this and said? Yes, this is good brittle anybody that we trust I.

E

Utakata speaking so before, taking this past need some to clarify. Actually the secret implication of the extension, so I think new thing, just in the simple way to her. She is easy, but it is not always clear that the such modification actually gives more security or not so especially for salt. We need the Korean aces of the security game and we must describe it clearly. Intoxicated consideration, sections I.

F

Think that the salt I, don't think that the salt thing was for security reasons is mainly for the use case that the database, for example, is compromised and they don't want to change the rooms. Instead, they just change that that that salt to keep those rooms intact.

E

Five, so that's very honestly speaking it it's the only reason: I, don't like this idea, because because this kind of hashing is always the victim was a password dictionary attack. So so the use of the same person said name just changing, assaulted, a dangerous in some cases, so he doesn't be decree about that. I think.

F

The salt doesn't really change that that I, what.

E

I, don't think it gives a better security solution again.

F

And the claim is not that.

E

It's a second issues: oh okay, I.

F

Don't think the claim was that it has any from a security perspective that as much.

E

Value or any other words easy actually, safety is the same password. Only changing the salt in such to.

F

No, no, it doesn't hassle to be changed for sure it's the realm that they want to change. The password will change the database compromise that, as.

E

Well, as those why you don't want them to be changed, if you don't.

F

E

To change or Posada because.

F

You have you have to touch different servers. Do that if you, if you change the salt, you just say that so.

E

Can you create in such a use case in the side yep, maybe.

F

There again I'm.

F

Like a doubt, that was it, do you have any an a use case example for what this like yeah go ahead.

D

Yes, sir marketing and I am one of the co-editor of so the idea is that if database is compromised- and you don't want to change your hidden, just obviously need you bass well, but which are.

D

E

If the audience's must change password, is it any different? Some just invited our existing entrance dee dee any code is new password entry accepted.

D

If the user of a user's same as well.

E

At least he said it may be dangerous situation. Yes,.

D

Because I'm then.

B

Just repeat what goes on the wire: what.

F

Goes on the wire yeah. You just add that damn that salt to what you have so the hash instead of hashing username round and password you hash, username realm password and salts, trying.

B

Don't have the proposal front of you soon, it's yeah some food is under vice-like.

F

So the a1 instead of username and password, you just add salt, and that the hash of God.

B

Yeah some wonder if the if the password database has to change because of this so.

F

So, typically, in those use cases they were talking about assault. / database is not assault. Better user I.

B

So I look at one of the secure takes things like yesterday that you're going to talk about next. This usually mean that the server has to have has to store the actual passwords rather than the salted hash database. So these.

D

B

Because when it fester p, the server and client are doing some collective calculation. The server has to have the clear text password.

F

No not where this RP, but but what I'm talking.

B

About this one here, this doesn't have such an implication for for the server the database can say the same database, yes, is useful.

F

Yeah yeah yeah I, don't know yeah. There is no clear text, a password room.

E

It's not great tastes that it's me often say that password equipment, because, ladies, it is for those situation.

F

But that doesn't change anything, that's an existing situation again. There is no claim here that the salt would add any security value here right. That's not what the claim right. The claim is it's for convenient reasons. If that database compromised, they don't want to force every element to change their own and start instead, just change the salt on the server write.

G

Your own chef I'm, not a cryptographer, but this looks like an abuse of H mac to me, but.

F

Now you're talking about that, the second one yeah.

G

F

G

It's mark is a maggot assumes a secret value and now we're using it just a little bit more mixing of it.

F

Is the Builder, if I guess so, no it'sit's? What's today that the digest mechanism saves that ha1 right? This is the password that I can.

G

See a shot, 256 I, don't know what the h mark is doing down there.

F

Ok, so again that the idea is that that k, deep function they today that the way it is used today is just concatenate in back hahha, one with the rest right and then hash. It's right. Instead of doing that, because there's a need for a really keyed mechanism. Instead of doing that, you use the ha1 as that they're, the key and the rest as as that message itself right. So.

G

What was 82 coming from wait? Hho.

F

Hho, like it, doesn't affect that the calculation here ha2 is staying the same thing right. Well, not it's! It's! It's eight, a one that is changing and the KD function that will change right, Oh.

F

What's a to its III I, don't remember the details like it's. It's yeah! No, no I! I! Don't have it here. Okay, it's not it's not changing secret. No! No! It's not a secret plan. You know.

F

Ha1 is secret right again.

B

F

Is the secret that is stored on the database right.

E

Again, we need some deer and of introducing hmm in the creation scripture, so without that, if just tickets stirring this up these two parameters, a similar just concatenating it hashing is fine. So we need a clear reason why we put H one direction side and other things right hand side and for the solid state has to issue.

E

If carrying the current discussion, I'm strongly against adopting this technique, because it gives a very bad in but confusion to the user, so we must clearly say what is again and what is the meaning of that once we can. So if, as web databases leak, we should do in this way instead of this way, so that security issue will not be getting worse. So is that such kind of description and connected against taking this to the standard read by any stage of protocol exchange.

D

Okay, I canna partisan and I am a cryptographer, oh good. We.

F

Have somebody under.

D

The assumption that the only secret value here is passport, everything else is known to the bursary. This proposal adds no extra security on top of just mashing. Okay, no extra security. You can magic up entropy out of nothing like your only secret as a password, so maybe there's some reason why you want to have a key derivation function here, some exterior reason, but it cannot be secured. Okay,.

F

B

Hey anything else, okay, so the response has been kind of negative. If your others still think it's a good idea, please submit a draft and then we can have more concrete short responses to.

F

And that's reason: I did not submit a draft ring.

B

So get your other one up to make sure it opens with non beta version.

F

Okay, so um yeah, no, no no I have been discussing different options for a replacing digest with the with a better mechanism. So this is kind of a result of that discussion. So next slide, please it so that the proposal he is to use SLP as a as a mechanism to to replace digest. So am some background about SF visa is a royalty-free, a protocol. They will define and it's been defined and used by a different in ITF RFC's.

F

It's defined in that and the first one and it's it's used by a other tool there, it's a with the tell nathan and TLS and- and it has a variety of implementations, implemented already, and they many people use it already.

F

Next slide, please so a secure, remote password is a augmented, take password that is used to authenticate users using some shared key or shake shipped a secret, both sides, as a result of that you you get them and you create a shed a key at the end of that process a and it doesn't require any pkoi or throw a party. This high level next slide, please so a at a high level.

F

A we're talking about a and a framework that is based on SRP, on top of the existing HTTP, a framework a that could be used for HTTP sip other protocols that use that challenge response mechanism.

F

We're not expecting this to be used for a genetic web traffic, it's resistant to fishing. So if you go to am a wrong website, you don't expose a any information about the password and resistant to dictionary. Attacks next slide, please so a that.

F

But at the beginning, that is a setup on the server side to a the server will use a large primary generator and then, when a user account is created and that server select a hash function and user salt in this case, is that the salt is a user-specific a and it uses the realm and a password to create a password verifier. The password very vile is created. It created using two steps.

F

The first one is derived keep a private key, which is the hash of username or password and salt, and then that password verify is a generator to the power of that derived a private key, a modulo, a large prime. All the calculations or emerging lot farm and then that data is stored in the database notice that the derived private key is not stored in a database, so so that nor the hash over the passage itself is not stored in the database ring next like these.

F

So this is just to a that. The authentication process requires the first initial request, so include the username. So if that user name is not known to a the client, this is a way just to kind of discover that and you're talking a few comments about this, and you can- and you can adjust it to to that. So this is just a discovery process. Next, next one please so that the authentication process starts by it out after that client sending that they use a name to to a server.

F

The server uses that user name to a it affect the information about that user that you password verify and then a challenge is that request includes a large primes generator, the hash algorithm assault and that service public key, creates a server public key for that specific, a session and sends that back to to the client.

F

The client gets that information raised by a client public key side creates a a session key and it creates create a client, a preferred position to make sure or tell the server that it is now in position of that of that session key and said that information back to that server.

F

The server uses that service public key to associate that those two requests and then verifies that point p, 0, p and a it, creates that that a session locally and sends a service top-2 back to him to the client and the clients verifies that right, but at the high level. That's that's the process next slide. Please so I benefits a resistant to a passive and active attacks. It provides a perfect perfect, a forward 6 UC and again it never stores, passwords or hashes on the database. Only the password verify or switch.

F

If that is compromised, the attack, you can't use those gerroff rise to compromise the system right. So that's sort of a benefit to this email and that's about it. I think next slide. Please that's.

D

It questions comments and.

E

Neither boiler so I what, as far as I have from you it's a function, a subset of the mutual authentication. Currently so so the user authentication is actually the how the cake, augmented cake can be implementing the HTTP both who are web and no web traffic. So because I already constables use cases, and it's also, it is also designed as a algorithm AJ as a piece or you can use a therapy just by putting side as much education into it. So please, please beat my draft sure.

F

Array that but but but one of the advantages SOP, is that it's already implemented a warrior.

E

Usual, yes, you can just put the surfing I. My draft is composed of the basic frame in other, isn't so you can just write. Algorithm I see recipe to use the measles in kitchen, okay,.

F

I'll take lockup and.

E

Also for the it's for technical things, so kissing is not just stealing the password so up to prevent any kind of the phishing attacks. You must have a channel binding, I chairman.

F

E

Yeah we said that the attacker can pull out the request in performative, successful authentication and you attack against use a little of the HTTP of traffic. So you definitely need channa, binding okay,.

F

Mean our comments.

G

It won't show for I think this is so technically. I agree with you about China binding, formally anything care, you're sort of extending the definition of fishing, but yeah Jenna funding would be needed, even though I selfie, as is resistant to fishing and one more technical comment, a my responsibility. We know that this is resistant to dictionary attacks on the server, and this is actually infrared but, as I can see,.

B

Okay now remind everyone that this still is not autographed ya, doing our own draft and then we'll see a free. haha That's.

D

More yes, on fishing I had a whole big arguments even on this. I have.

G

A much broader definition.

D

Of it, because it involves lots of different attack types, it can steal all sorts of credentials, it can download malware onto systems.

B

Speaking with no hats to me, fishing is a social attack. It's sure the people can couldn't, you know, can convince you to do all sorts of things with the best intentions and it's really hard to stop them from doing its technical.

D

Tony handsome, when you do right this episode, graph, I suggest you follow the example that Alexei did with the basics before encoding the set of stuff that gets passed into the algorithm, so that now that can its then encapsulate it as a single chunk that just passed through the implementations. So.

F

We do have addressed.

D

For this one, okay, yeah.

F

So but yeah, okay, I.

D

Encourage you to follow his example. You.

F

Sure I'll take a look. Okay. Thank you.

F

Any other comments and anything else, any cryptographer here and.

B

Fragra fees, prague refer, is not going to say, stand against this okay.

B

It's not yet okay,.

D

Okay, thank you guys. Okay,.

B

That's we've been doing things rather quickly, so you reach the time for open mic.

E

Just an announcement from the awesomest arrow syndication and as oh you already said, I perish the current XMS ourselves. A my draft. Does a github so of course, I'm not asking every you to delights my document, but if you'll find it is helpful for you, please feel free to use it in some it to email requests for that. But of course you can ask me to change the draft XO well.

B

Requests are fine, and we did mention in the previous session that the drafts needs some work in there at least language and, though, are perfect for bullet resto. Anybody volunteer to do that. They'll think we have some stars somewhere here, yeah, so anything else good then we'll adjourn early and we can get at the cookies before all the others.

B

Right, okay, are the games.

B

There are too few of them, went through them in 10 minutes.

B

Okay, so did everybody sign the blue sheet? You haven't, please find it it's probably somewhere in the back yeah there. It is just sign it and bring it back here.

A

A