CURRENT MEETING REPORT

Minutes of the WTS Working Group

Reported by: Charlie Kaufman, Iris Associates

The WTS working group met on Wednesday afternoon March 6th.

It was noted that we had reached consensus on the final wording changes of the requirements document at the previous meeting, but that the changes were not completed until after the I-D deadline ahead of this IETF. We will have a working group last call as soon as they are posted.

Doug Rosenthal was unable to attend this meeting, so we got no update on the status of his GSSAPI-WWW work.

Eric Rescorla led was a brief review of the changes in the SHTTP spec (now two specs - one for SHTTP and one for SHTML) in the most recent draft; the contents of the slides from that presentation are appended to the end of these minutes. There was consensus that the technical content was mature enough for the document to advance, but that some substantial wording changes may be required to clarify the relationship between SHTTP and HTTP, and in particular how the evolution of the two will be coordinated.

HTTP 1.0 is a "Best Current Practice" RFC. Work on HTTP 1.1 is ongoing and likely to be advanced in the standards track in the next few months. SHTTP can be thought of as an enhanced version of HTTP or it can be thought of as an independent protocol that is optimized for carrying HTTP as a payload and just happens to look a lot like HTTP. In the former case, the spec should be stated as a set of deltas from the HTTP spec so that changes to HTTP would automagically be inherited by SHTTP. In the latter, changes to the HTTP spec would make it desireable (and possibly necessary) to make parallel enhancements to SHTTP.

The procedural issue was raised as to whether the SHTTP document could be advanced if it references either the BCP HTTP 1.0 spec or the not yet advanced HTTP 1.1 spec. After much wandering in the wilderness, that conclusion was that we could advance the SHTTP spec if it contained the right wording regarding its relationship to those two documents. John Klensin volunteered to help us get that wording right.

The question was asked whether the addition of the key word "WRAPPED" in the SHTTP header would make SHTTP more compatible with the HTTP direction, and the somewhat confused consensus was that it probably would not. The question was asked what the relationship should be between SHTTP and the PEP and SEA work going on in W3C. The consensus was that this should be considered in the next round of SHTTP design after that work was more mature.

Hope was expressed that the wording changes could be made to the spec, review could take place on the list, and the document could go to last call ahead of the next IETF meeting.

Slides from the Technical Review

• S-HTTP Status-Eric Rescorla (ekr@terisa.com),Terisa Systems
• Split Into Two Drafts (As discussed at Dallas)
• S-HTTP protocol: draft-ietf-wts-shttp-01.txt
• HTML extensions: draft-ietf-wts-shtml-00.txt

Major Changes

• HTML extensions now separate
• Syntax for binding options to anchors with headers Addition of HMAC
• More support for proxies
• A lot of explanatory text

• HTML extensions: Same as before, but in a separate draft.
• Options in headers for clients: By default, headers apply to all anchors
• SHTTP-Cryptopts-Scope: binds the following; headers to named references in following document (for HTML use the NAME attribute, but applicable to any hyperlinkable media)
• Addition of HMAC: Old MAC syntax persists, but HMAC required for v1.2
• Proxy support (Even for confidential information)
• Confidentiality (and to some extent security in general) conflicts with caching.
• Canonically: Caches can't see the data _or_ cache it; caches see all the data and can cache it S-HTTP supports caching even when proxies aren't trusted to see the data
• Proxy Support: How Client- If-Modified-Since allowed in S-HTTP headers
• Server- Sends 320 SHTTP Not Modified response; sends keying material but not encrypted content
• Preenhanced documents: Server caches documents it's already enhanced; security improvement; authenticated data can be served off untrusted machines.
• Performance improvement
• Explanatory text: hopefully needs no explanation

Minor (really) Edits Still To Come

• replace: HMAC -> HMAC-1; PEM -> MOSS, separate Document (?)