Re: [kitten] Fw: New Version Notification for draft-mills-kitten-sasl-oauth-02

[Simon Josefsson <[e-mail]>]

"William J. Mills" <[e-mail]> writes:

> All,
>
> I have added channel binding to OAUTH mechanism draft.  I would very
> much appreciate someone that knows CB giving it a read to make sure
> I'm on the right track.  Significant changes in this draft:

This is great!

   Channel binding [RFC5056] in this mechanism is defined in order to
   allow satisfying the security requirements of the authorization
   schemes used.  This document defines the "OAUTH-SSL" mechanism to
   provide TLS channel binding [RFC5929] to the OAUTH mechanim, and
   specifically the "tls-unique" type of channel binding.

The intention is that tls-server-end-point is not permitted at all,
right?  Perhaps it is clearer to have the last sentence say

   This document defines the "OAUTH-SSL" mechanism to provide the
   "tls-unique" TLS channel binding [RFC5929] to the OAUTH mechanim.

      cbdata (REQUIRED):  Contains the base64 encoded first TLS Finished
         message sent.

Don't mention the Finished message here, people have gotten the details
wrong before and the gory details (including people's mistakes) are in
RFC 5929.  Say instead:

      cbdata (REQUIRED):  Contains the base64 encoded "tls-unique"
         channel binding data.

Otherwise it looks good.  I'm tempted to have a go at implementing this
in GNU SASL actually. :-)

/Simon