Re: [OAUTH-WG] MAC Tokens body hash

"William J. Mills" <> Mon, 01 August 2011 15:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 49C3211E8108 for <>; Mon, 1 Aug 2011 08:41:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -15.926
X-Spam-Status: No, score=-15.926 tagged_above=-999 required=5 tests=[AWL=-0.928, BAYES_50=0.001, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EiMEcR+1VqZg for <>; Mon, 1 Aug 2011 08:41:09 -0700 (PDT)
Received: from ( []) by (Postfix) with SMTP id F21D911E8106 for <>; Mon, 1 Aug 2011 08:41:08 -0700 (PDT)
Received: from [] by with NNFMP; 01 Aug 2011 15:41:12 -0000
Received: from [] by with NNFMP; 01 Aug 2011 15:41:12 -0000
Received: from [] by with NNFMP; 01 Aug 2011 15:41:12 -0000
X-Yahoo-Newman-Property: ymail-3
Received: (qmail 24843 invoked by uid 60001); 1 Aug 2011 15:41:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=ginc1024; t=1312213271; bh=b6gL9uBn2kQWCr44VAGtn0Gml+h5mQ13iC/CQbXR7Rs=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Z4dxX/Ornw3BDBI+3RqUN3zi4X+pOVBVzbVCD4UEXqbCkPE9lTQZhbywI+1NAHq/tC4pMGDo1dQAjVVSsKLmkVnT5vQRZPwcQf1hPQecsWAfSzlMxKgbewCkBR5meQ3ERcP9jQ939Qn321w+CmIQBWbhzgJQMROdkbsBWheoJz0=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024;; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=c0RcwzUbF+CckT/FtYVFDQcWQkqK5xTXCCK8XVYITtaco3ptjuN9bZpoThgNe1IKeJ4zyZ6ipysVoRLbYQ+woT0D7Ps5c2q7HruX8J3AclLt7h/ikzwMG/U6vIX1ZXlVwEpK4cMFSWi1RRLpSGz6RNi/7yavKYDr8rAKGTxIddI=;
X-YMail-OSG: XXBz_G4VM1k_VOeQvBkfS9QA_vCclpXsVBbOJgboR2DegSQ _JZ4n_g2aDX__UGyKkAdgsDx3w4tc4Qw5M7RqEqhY59ThV1wFln363ZtW4r8 vEZC2yU7l9r2hsJRjId7oYf3W7Gqgl3grylID2nmY6P3xsesUQc_g9LrJF7g yJ7HxiXHouPQokrKALQ9DtwmckHkQ14UJahsKulaNROpd4zLvTSrK6TZsNgK dS4HOqKHkCjrPclLnAPkNicp5ZzZtoFjlrUsSOODwhqdmZtW38murefWZd7z 3qngm0iNjZ9oqZBojCEyOyp.1PC0mguaRBOrqOKsnkzCTjq1GTwe95FvwBDB y8oNpsih_oEwm
Received: from [] by via HTTP; Mon, 01 Aug 2011 08:41:11 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/
References: <90C41DD21FB7C64BB94121FBBC2E723450245F611B@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Message-ID: <>
Date: Mon, 01 Aug 2011 08:41:11 -0700
From: "William J. Mills" <>
To: Eran Hammer-Lahav <>, OAuth WG <>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E723450245F611B@P3PW5EX1MB01.EX1.SECURESERVER.NET>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-170212033-1312213271=:20715"
Cc: Ben Adida <>, "'Adam Barth ('" <>
Subject: Re: [OAUTH-WG] MAC Tokens body hash
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: "William J. Mills" <>
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 01 Aug 2011 15:41:10 -0000

Instead of "body" hash why not make it a payload hash or additional hash.  The app can include a hash of data there as defined by the app, and you've reserved a spot for that.

From: Eran Hammer-Lahav <>
To: OAuth WG <>
Cc: Ben Adida <>; "'Adam Barth ('" <>
Sent: Friday, July 29, 2011 6:43 PM
Subject: [OAUTH-WG] MAC Tokens body hash

I plan to drop support for the bodyhash parameter in the next draft based on bad implementation experience. Even with simple text body, UTF encoding has introduced significant issues for us. The current draft does not work using simple JS code between a browser and node.js even when both use the same v8 engine due to differences in the body encoding. Basically, the JS string used to send a request from the browser is not the actual string sent on the wire.
To fix that, we need to force UTF-8 encoding on both sides. However, that is very much application specific. This will not work for non-text bodies. Instead, the specification should offer a simple way to use the ext parameter for such needs, including singing headers. And by offer I mean give examples, but leave it application specific for now.
I am open to suggestions but so far all the solutions I came up with will introduce unacceptable complexity that will basically make this work useless.
OAuth mailing list