Re: [OAUTH-WG] HTTP Signing

[Justin Richer <[e-mail]>]

That document has been brought up and discussed several times in the past in relation to our own signing mechanism, and it’s been rejected each time. It has its benefits and drawbacks, as does the signature method that was proposed in draft-ietf-oauth-http-signing. The biggest drawback of the cavage document is that it is not as robust against HTTP message transformation as the oauth document. The oauth draft uses the JOSE signing mechanism (which is familiar to a lot of OAuth developers already) whereas the cavage draft has its own signing system. The cavage draft ties more directly to HTTP2, whereas the oauth draft ties more directly to, well, OAuth. To wit, you’d still need to define a way to present the access token itself alongside the signature, presumably using another header which would be signed.

The thing is, the challenge has never been with the specifics of how the signatures are made in the oauth draft — the challenge has been whether to do message level signatures at all. The token binding camp remains convinced that referred token binding will be both universally available and universally applicable, and that work has very directly pulled interest and attention away from having a true PoP solution in a standard, even five years after we had a reasonably workable draft (in the form of the MAC token) that we could have built and run with.

 — Justin

> On Mar 28, 2017, at 2:32 PM, Hannes Tschofenig <[e-mail]> wrote:
> 
> Hi all,
> 
> I met Manu after the OAuth meeting on Monday and he pointed me to his
> work on HTTP signing, as described in this document:
> https://tools.ietf.org/html/draft-cavage-http-signatures-06
> 
> I believe there is some synergy of work going on elsewhere in the IETF.
> Since we have had challenges with some HTTP signing I wonder whether
> there is something to learn from the authors of that doc.
> 
> Ciao
> Hannes
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth