search

w3c / wot-security

a repo exclusively for security to better manage issues and security considerations for WoT
https://w3c.github.io/wot-security/
18 stars 22 forks source link

Consider adding TLS-SRP authentication scheme #97

Closed mmccool closed 5 years ago

mmccool commented 6 years ago

An optional password is supported in TLS via the “Secure Remote Password” protocol (SRP) which extends TLS to mutual authentication (authenticating the client to the server, not just the server to the client) without requiring installation of a certificate on the client. This can be seen as an alternative to basic or digest authentication.

See https://en.m.wikipedia.org/wiki/Secure_Remote_Password_protocol

mmccool commented 6 years ago

(Feedback from Elena Reshetova): Whether or not we support this depends on whether we know of any IoT devices that use it. That should be our general policy. (Feedback from Michael Koster): This is not really the place we want a user to authenticate, but it may be suitable for a proxy. I agree we need a use case first.

mmccool commented 6 years ago

Will leave open but suspend action on it unless we see an actual use case. Marked as "SUSPENDED" which means "won't fix unless someone comes up with a use case that needs it."

mmccool commented 5 years ago

Think we can close this, will reopen if necessary.