[OAUTH-WG] Fwd: I-D Action: draft-ietf-oauth-dpop-02.txt

[Brian Campbell <[e-mail]>]

I've published a somewhat overdue -02 revision of DPoP.  The changes in
this revision, which aim to address feedback and discussion from the list
and prior interim, are summarized below in text copied from the Document
History.The changes are a bit difficult to summarize though because, while
the document has gotten a bit of an overhaul, the actual protocol bits are
mostly unchanged. I do hope and think, however, that this new revision will
be easier to digest.

Note also that DPoP is the topic for the next interim meeting later this
month
https://datatracker.ietf.org/meeting/interim-2020-oauth-16/session/oauth
whre I plan to do a similarly poor job explaining the recent updates.

  Changes in -02:

   *  Lots of editorial updates and additions including expanding on the
      objectives, better defining the key confirmation representations,
      example updates and additions, better describing mixed bearer/dpop
      token type deployments, clarify RT binding only being done for
      public clients and why, more clearly allow for a bound RT but with
      bearer AT, explain/justify the choice of SHA-256 for key binding,
      and more

   *  Require that a protected resource supporting bearer and DPoP at
      the same time must reject an access token received as bearer, if
      that token is DPoP-bound

   *  Remove the case-insensitive qualification on the "htm" claim check

   *  Relax the jti tracking requirements a bit and qualify it by URI

---------- Forwarded message ---------
From: <[e-mail]>
Date: Wed, Nov 18, 2020 at 3:26 PM
Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-dpop-02.txt
To: <[e-mail]>
Cc: <[e-mail]>



A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.

        Title           : OAuth 2.0 Demonstrating Proof-of-Possession at
the Application Layer (DPoP)
        Authors         : Daniel Fett
                          Brian Campbell
                          John Bradley
                          Torsten Lodderstedt
                          Michael Jones
                          David Waite
        Filename        : draft-ietf-oauth-dpop-02.txt
        Pages           : 29
        Date            : 2020-11-18

Abstract:
   This document describes a mechanism for sender-constraining OAuth 2.0
   tokens via a proof-of-possession mechanism on the application level.
   This mechanism allows for the detection of replay attacks with access
   and refresh tokens.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-dpop/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-oauth-dpop-02.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-dpop-02


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


_______________________________________________
OAuth mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/oauth

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._