Subject: Re: [Last-Call] Secdir last call review of draft-ietf-httpbis-bcp56bis-12

From: Joseph Salowey <[email-masked]>
Date: Mon, 2 Aug 2021 13:33:48 -0700

On Sun, Jul 25, 2021 at 7:43 PM Mark Nottingham <[email-masked]> wrote:

> Thanks for the review. I've opened an issue to track it:
>   https://github.com/httpwg/http-extensions/issues/1582
>
> Responses below.
>
>
> > On 26 Jul 2021, at 3:30 am, Joseph Salowey via Datatracker <
> [email-masked]> wrote:
>
> > Major Issues:
> >
> > + I had trouble with section 4.12 Client Authentication which states:
> >
> > "Applications can use HTTP authentication Section 11 of
> > [I-D.ietf-httpbis-semantics] to identify clients. The Basic
> authentication
> > scheme [RFC7617] MUST NOT be used unless the underlying transport is
> > authenticated, integrity-protected and confidential (e.g., as provided
> the
> > "HTTPS" URI scheme, or another using TLS). The Digest scheme [RFC7616]
> MUST NOT
> > be used unless the underlying transport is similarly secure, or the
> chosen hash
> > algorithm is not "MD5"."
> >
> > I'm not sure what the "or chosen hash algorithm is not "MD5" is meant to
> say.
> > What I think the document should say is:
> >
> > The Digest scheme [RFC7616] MUST NOT be used unless the underlying
> transport is
> > similarly secure. The "MD5" digest algorithm MUST NOT be used.
>
> Hmm. I forgot that RFC7616 has a pre-existing requirement in Section 5.1:
>
> > If Digest Authentication is being used, it SHOULD be over a secure
> channel like HTTPS [RFC2818].
>
> Are we saying that that SHOULD is really a MUST for all uses of HTTP, or
> just those in scope for this document? Likewise for the effective
> deprecation of md5.
>
> If so, perhaps the easiest thing to do would be to state that clearly;
> e.g.,
>
> """
> [RFC7616] Section 5.1 recommends that the Digest scheme be used over a
> secure channel like HTTPS. This document strengthens that recommendation to
> MUST, and deprecates the md5 hash algorithm in the Digest scheme.
> """
>
> ... and listing 7616 as being updated by this document.
>
> Thoughts?
>

[Joe]  I think we should deprecate MD5 in all cases and I also think you
should treat digest as basic auth and run it over a secure channel in all
cases.  The text update looks good.

>
> > + There is a security consideration that I think the document should
> cover.
> > Many HTTP based protocols make heavy use of bearer tokens, such as
> session
> > cookies, for authentication and authorization purposes.  This means that
> an
> > attacker that can eavesdrop on HTTP communications can often escalate
> their
> > privilege to perform operations on resources.   I think you could add
> this to
> > the security considerations:
> >
> > " Section 4.4.2 requires support for 'https' URLs, and discourages the
> use of
> > 'http' URLs, to provide authentication, integrity and confidentiality,
> as well
> > as mitigate pervasive monitoring attacks.  Many HTTP based protocols
> make heavy
> > use of bearer tokens, such as session cookies, for authentication and
> > authorization purposes.  This means that an attacker that can eavesdrop
> on HTTP
> > communications can often escalate their privilege to perform operations
> on
> > resources. "
>
> See
> https://github.com/httpwg/http-extensions/commit/fe3f298e4d60514306e391398cc870abaedd8bf9
>
> [Joe] Looks good.

> > Minor Issues:
> >
> > + Section 4.5.1 - This could be a good place to mention RFC-8470 on TLS
> 1.3
> > early data which can also be a source of GET request replay
>
> See
> https://github.com/httpwg/http-extensions/commit/b03c376179e278deb3d994eac152c6a131702840
>
>
[Joe] I left a comment with a text suggestion.

> Cheers,
>
> --
> Mark Nottingham   https://www.mnot.net/
>
>

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 3 Aug 2021 10:50:39 +1000

Hi Joe,

> On 3 Aug 2021, at 6:33 am, Joseph Salowey <[email-masked]> wrote:
> [Joe]  I think we should deprecate MD5 in all cases and I also think you should treat digest as basic auth and run it over a secure channel in all cases.  The text update looks good.  

There's been some... pushback on list since:
  https://www.w3.org/mid/[email-masked]

Would you be comfortable if we just removed the discussion of digest and MD5 completely, and deferred action to an (eventual) update of 7616?

Cheers,

---

From: Joseph Salowey <[email-masked]>
Date: Tue, 3 Aug 2021 09:46:51 -0700

On Mon, Aug 2, 2021 at 5:50 PM Mark Nottingham <[email-masked]> wrote:

> Would you be comfortable if we just removed the discussion of digest and
> MD5 completely, and deferred action to an (eventual) update of 7616?
>
>
[Joe]  The document is already down the path of adding normative language
around 7616 by requiring a secure channel just when using digest MD5.
 This guidance doesn't seem specific to the APIs case.  Why can't
the document improve the normative guidance to update to MUST NOT use MD5
and MUST use a secure channel with digest?

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 Aug 2021 09:21:48 +1000

> On 4 Aug 2021, at 2:46 am, Joseph Salowey <[email-masked]> wrote:
> 
> [Joe]  The document is already down the path of adding normative language around 7616 by requiring a secure channel just when using digest MD5.   This guidance doesn't seem specific to the APIs case.  Why can't the document improve the normative guidance to update to MUST NOT use MD5 and MUST use a secure channel with digest?  

The proposal was to remove discussion of MD5 *and* digest, deferring to 7616 (and an eventual update).

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 Aug 2021 11:51:58 +1000

See:
  https://github.com/httpwg/http-extensions/commit/9f3c2faa3

This fits in with the overall approach of the document -- as a BCP, we're shying away from placing requirements on implementations. 

Cheers,

> On 4 Aug 2021, at 9:21 am, Mark Nottingham <[email-masked]> wrote:
> 
> 
>

---

From: Joseph Salowey <[email-masked]>
Date: Tue, 3 Aug 2021 22:27:17 -0700

On Tue, Aug 3, 2021 at 6:52 PM Mark Nottingham <[email-masked]> wrote:

> This fits in with the overall approach of the document -- as a BCP, we're
> shying away from placing requirements on implementations.
>
>
[Joe] Thanks, this looks good.

> >> Would you be comfortable if we just removed the discussion of digest
> and MD5 completely, and deferred action to an (eventual) update of 7616?
> >>
> >>
> >> [Joe]  The document is already down the path of adding normative
> language around 7616 by requiring a secure channel just when using digest
> MD5.   This guidance doesn't seem specific to the APIs case.  Why can't the
> document improve the normative guidance to update to MUST NOT use MD5 and
> MUST use a secure channel with digest?
> >