a Secarta project ...

HTTPsec Authentication Protocol

[ View as one printable page ]

Preamble

1. Introduction

1.1. Editorial Conventions

1.2. Terms

1.3. Identifiers

2. Summary

2.1. Authentication Model

2.2. Peer Identifiers

2.3. Protocol Operation

2.3.1. Initialization

2.3.2. Continuation

3. Protocol Messages

3.1. Initialization Messages

3.1.1. Initialization Request

3.1.2. Initialization Response

3.2. Continuation Messages

3.2.1. Continuation Request

3.2.2. Continuation Response

3.3. Challenge Messages

3.3.1. Challenge Response

3.4. Message Flow

4. Protocol Directives

4.1. id

4.2. dh

4.3. certificate

4.4. url

4.5. group

4.6. nonce

4.7. auth

4.8. token

4.9. signature

4.10. count

4.11. mac

4.12. digest

5. Other Headers

5.1. Content-Encoding

5.2. Cache-Control

5.3. Expires

6. Protocol Computations

6.1. Algorithms

6.1.1. Hash Algorithm

6.1.2. Public Key Algorithm

6.1.3. Encryption Scheme

6.1.4. Signature Scheme

6.1.5. Block Cipher

6.1.6. Block Cipher Mode

6.2. Header Canonicalization

6.3. Initialization Transcript

6.4. Continuation Request Transcript

6.5. Continuation Response Transcript

6.6. Shared Secret

6.7. Keys

6.7.1. MAC Keys

6.7.2. Cipher Keys

6.8. Message Body Ciphering

7. Message Validation

7.1. Initialization Request Validation

7.2. Initialization Response Validation

7.3. Continuation Request Validation

7.4. Continuation Response Validation

8. Cache Considerations

9. Security Considerations

10. References

11. Editor Address

10. References

Normative references:

AES: FIPS 197. Specification for the Advanced Encryption Standard (AES) National Institute of Standards and Technology. November 2001.
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
CBC: SP 800-38A. Recommendation for Block Cipher Modes of Operation. Morris Dworkin. December 2001.
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
DATA: RFC 2397. The "data" URL scheme. L. Masinter. August 1998.
http://www.ietf.org/rfc/rfc2397.txt
HMAC: RFC 2104. HMAC: Keyed-Hashing for Message Authentication. H. Krawczyk, M. Bellare, R. Canetti. February 1997.
http://www.ietf.org/rfc/rfc2104.txt
HTTP: RFC 2616. Hypertext Transfer Protocol -- HTTP/1.1. J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, T. Berners-Lee. June 1999.
http://www.ietf.org/rfc/rfc2616.txt
HTTP Authentication: RFC 2617. HTTP Authentication: Basic and Digest Access Authentication. J. Franks, P. Hallam-Baker, J. Hostetler, S. Lawrence, P. Leach, A. Luotonen, L. Stewart. June 1999
http://www.ietf.org/rfc/rfc2617.txt
KEYWORDS: RFC 2119. Key words for use in RFCs to Indicate Requirement Levels. S. Bradner. March 1997.
http://www.ietf.org/rfc/rfc2119.txt
MODP: RFC 3526. More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
http://www.ietf.org/rfc/rfc3526.txt
PKCS#1: PKCS #1 v2.1. PKCS #1 v2.1: RSA Cryptography Standard.
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf
PKCS#5: PKCS #5 v2.0. PKCS #5 v2.0 Password-Based Cryptography Standard
ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-6.asc
SHA: FIPS PUB 180-2. Secure Hash Standard.
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf
URI: RFC 3986. Uniform Resource Identifiers (URI): Generic Syntax. T. Berners-Lee, R. Fielding, L. Masinter. August 1998.
http://www.ietf.org/rfc/rfc2396.txt
URL: RFC 1738. Uniform Resource Locators (URL). T. Berners-Lee, L. Masinter, and M. McCahill. December 1994.
http://www.ietf.org/rfc/rfc1738.txt
X509: RFC 2459. Internet X.509 Public Key Infrastructure Certificate and CRL Profile. R. Housley, W. Ford, W. Polk, D. Solo
http://www.ietf.org/rfc/rfc2459.txt