Re: [OAUTH-WG] New Version Notification for draft-sakimura-oauth-tcse-00.txt

[Nat Sakimura <[e-mail]>]

Hi.

I had to fix a few issues with the previous draft text.
No normative changes, but just removed some extra text.

Nat

---------- Forwarded message ----------
From: <[e-mail]>
Date: 2013/7/31
Subject: New Version Notification for draft-sakimura-oauth-tcse-01.txt
To: Nat Sakimura <[e-mail]>, John Bradley <
[e-mail]>, Naveen Agarwal <[e-mail]>



A new version of I-D, draft-sakimura-oauth-tcse-01.txt
has been successfully submitted by Nat Sakimura and posted to the
IETF repository.

Filename:        draft-sakimura-oauth-tcse
Revision:        01
Title:           OAuth Transient Client Secret Extension for Public Clients
Creation date:   2013-07-30
Group:           Individual Submission
Number of pages: 7
URL:
http://www.ietf.org/internet-drafts/draft-sakimura-oauth-tcse-01.txt
Status:          http://datatracker.ietf.org/doc/draft-sakimura-oauth-tcse
Htmlized:        http://tools.ietf.org/html/draft-sakimura-oauth-tcse-01
Diff:
http://www.ietf.org/rfcdiff?url2=draft-sakimura-oauth-tcse-01

Abstract:
   The OAuth 2.0 public client utilizing authorization code grant is
   susceptible to the code interception attack.  This specification
   describe a mechanism that acts as a control against this threat.





Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat




-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en


2013/7/30 Nat Sakimura <[e-mail]>

> As some of you know, passing the authorization code securely to a native
> app on iOS platform is next to impossible. Malicious application may
> register the same custom scheme as the victim application and hope to
> obtain the code, whose success rate is rather high.
>
> We have discussed about it during the OpenID Conenct Meeting at IETF 87 on
> Sunday, and over a lengthy thread on the OpenID AB/Connect work group list.
> I have captured the discussion in the form of I-D. It is pretty short and
> hopefully easy to read.
>
> IMHO, although it came up as an issue in OpenID Connect, this is a quite
> useful extension to OAuth 2.0 in general.
>
> Best,
>
> Nat Sakimura
>
> ---------- Forwarded message ----------
> From: <[e-mail]>
> Date: 2013/7/30
> Subject: New Version Notification for draft-sakimura-oauth-tcse-00.txt
> To: Nat Sakimura <[e-mail]>, John Bradley <
> [e-mail]>, Naveen Agarwal <[e-mail]>
>
>
>
> A new version of I-D, draft-sakimura-oauth-tcse-00.txt
> has been successfully submitted by Nat Sakimura and posted to the
> IETF repository.
>
> Filename:        draft-sakimura-oauth-tcse
> Revision:        00
> Title:           OAuth Transient Client Secret Extension for Public Clients
> Creation date:   2013-07-29
> Group:           Individual Submission
> Number of pages: 7
> URL:
> http://www.ietf.org/internet-drafts/draft-sakimura-oauth-tcse-00.txt
> Status:          http://datatracker.ietf.org/doc/draft-sakimura-oauth-tcse
> Htmlized:        http://tools.ietf.org/html/draft-sakimura-oauth-tcse-00
>
>
> Abstract:
>    The OAuth 2.0 public client utilizing code flow is susceptible to the
>    code interception attack.  This specification describe a mechanism
>    that acts as a control against this threat.
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
>
> --
> Nat Sakimura (=nat)
> Chairman, OpenID Foundation
> http://nat.sakimura.org/
> @_nat_en
>



-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en