IETF Logo Mail Archive

Re: [OAUTH-WG] OAuth Security Discussions

Hannes Tschofenig <hannes.tschofenig@gmx.net> Mon, 17 September 2012 12:11 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C696321F865F for <oauth@ietfa.amsl.com>; Mon, 17 Sep 2012 05:11:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.059
X-Spam-Level:
X-Spam-Status: No, score=-102.059 tagged_above=-999 required=5 tests=[AWL=-0.460, BAYES_00=-2.599, J_BACKHAIR_22=1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iOk-1tu9bws5 for <oauth@ietfa.amsl.com>; Mon, 17 Sep 2012 05:11:30 -0700 (PDT)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by ietfa.amsl.com (Postfix) with SMTP id D553121F8650 for <oauth@ietf.org>; Mon, 17 Sep 2012 05:11:29 -0700 (PDT)
Received: (qmail invoked by alias); 17 Sep 2012 12:11:28 -0000
Received: from a88-115-216-191.elisa-laajakaista.fi (EHLO [192.168.100.200]) [88.115.216.191] by mail.gmx.net (mp020) with SMTP; 17 Sep 2012 14:11:28 +0200
X-Authenticated: #29516787
X-Provags-ID: V01U2FsdGVkX1+LkPhZDyaL5EngDrCRZR56KNdPn6RLsigeUXrMCr 96Sqpj/hOswbpT
Message-ID: <5057136C.6070600@gmx.net>
Date: Mon, 17 Sep 2012 15:11:24 +0300
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120827 Thunderbird/15.0
MIME-Version: 1.0
To: zhou.sujing@zte.com.cn
References: <OF6192366F.9DD38E70-ON48257A76.0011F223-48257A76.001221CB@zte.com.cn>
In-Reply-To: <OF6192366F.9DD38E70-ON48257A76.0011F223-48257A76.001221CB@zte.com.cn>
Content-Type: text/plain; charset="GB2312"
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: "oauth@ietf.org WG" <oauth@ietf.org>, oauth-bounces@ietf.org
Subject: Re: [OAUTH-WG] OAuth Security Discussions
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Sep 2012 12:11:32 -0000

> 
> Since it is prefered to have long lived key shared between AS and RS in 
> this WG,
> Is there any consideration for this key distribution and its security 
> requirements?

So far we have had only discussions regarding the standardization of the
AS<->RS server interaction in the context of the UMA work.

You may want to have a look at
http://tools.ietf.org/html/draft-hardjono-oauth-umacore

v2.23.0 | Report a Bug | By Email