IETF Logo Mail Archive

Re: [OAUTH-WG] [Ace] New OAuth client credentials RPK and PSK

Jim Schaad <ietf@augustcellars.com> Sun, 14 May 2017 20:33 UTC

Return-Path: <ietf@augustcellars.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22F18128B8E; Sun, 14 May 2017 13:33:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=augustcellars.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u_dWTlEVBJ8d; Sun, 14 May 2017 13:33:14 -0700 (PDT)
Received: from mail4.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0E04127977; Sun, 14 May 2017 13:29:09 -0700 (PDT)
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01D2CCB4.8D30C950"
Content-Language: en-us
DKIM-Signature: v=1; a=rsa-sha256; d=augustcellars.com; s=winery; c=simple/simple; t=1494793748; h=from:subject:to:date:message-id; bh=STC2dMLkpzH3n6mwKiHt/r7IpIZQlkciAOrTpUvFH2k=; b=SQGP8R8LY0hy8dNSYGFvfmX2oKn4XovTqTU7alsdFdi+Qh6GiZAzBWNjOIHC+uBvaV7/0rwlxHj 7qCVIU3azwCvxL4LR4BImMBO85Q6mOGtIt4xcxff1eO2znDNlKRtLY+RhxKg+DR31Giycof9z8jGs n8S18+hT7jG5HFFRkExBtuc+QSEZh5AP0HFb7r0RrR55RH/KVwuQ78cOK9jC6W2TDFPZzEVg9/FLS NpOUPsGQpQLwFztfScaH+bXFM8E3g2M46jf7m7nEHClp+BU9LQsfwrY1t+5bNz+aYe+QctXB2wD53 2Nm5qQiPQ51TD4exWBd0c83A/QGyO2udf6IA==
Received: from mail2.augustcellars.com (192.168.1.201) by mail4.augustcellars.com (192.168.1.153) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Sun, 14 May 2017 13:29:07 -0700
Received: from Hebrews (173.8.216.38) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Sun, 14 May 2017 13:29:00 -0700
From: Jim Schaad <ietf@augustcellars.com>
To: 'Samuel Erdtman' <samuel@erdtman.se>, oauth@ietf.org, 'ace' <Ace@ietf.org>
References: <CAF2hCbZpWTCMg617dK7D+F+0w=hxrz4VNdsFZHPGM1rZy+K3TA@mail.gmail.com>
In-Reply-To: <CAF2hCbZpWTCMg617dK7D+F+0w=hxrz4VNdsFZHPGM1rZy+K3TA@mail.gmail.com>
Date: Sun, 14 May 2017 13:18:14 -0700
Message-ID: <000501d2ccef$398d0940$aca71bc0$@augustcellars.com>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQF2pOMAEHj6tEKs9s8Af1VsoCYHA6KslJaw
X-Originating-IP: [173.8.216.38]
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/5kaSDX9LePNGn6AEbrOMU4G8uj4>
Subject: Re: [OAUTH-WG] [Ace] New OAuth client credentials RPK and PSK
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 14 May 2017 20:33:16 -0000

How is this draft supposed to interact with draft-gerdes-ace-dtls-authorize?

 

Jim

 

 

From: Ace [mailto:ace-bounces@ietf.org] On Behalf Of Samuel Erdtman
Sent: Friday, May 12, 2017 1:03 AM
To: <oauth@ietf.org> <oauth@ietf.org>; ace <Ace@ietf.org>
Cc: Ludwig Seitz <ludwig.seitz@ri.se>
Subject: [Ace] New OAuth client credentials RPK and PSK

 

Hi ACE and OAuth WGs,

I and Ludwig submitted a new draft yesterday defining how to use Raw Public Key and Pre Shared Key with (D)TLS as OAuth client credentials, https://datatracker.ietf.org/doc/draft-erdtman-ace-rpcc/.

 

We think this is valuable to the ACE work since the ACE framework is based on OAuth, but client credentials as defined in the OAuth framework are not the best match for embedded devices.

We think Raw Public Keys and Pre Shared Keys are more suitable credentials for embedded devices for the following reasons:

* Better security by binding to transport layer.

* If PSK DTLS is to be used a key need to be distributed any way, why not make use of it as credential.

* Client id and client secret accommodates for manual input by a humans. This does not scale well and requires some for of input device.

* Some/many devices will have crypto-hardware that can protect key material, to not use that possibility would be a waste.

* There are probably more reasons these was just the once on top of my head.

 

This is not the first resent initiative to create new client credential types, the OAuth WG adopted a similar draft for certificate based client credentials (https://tools.ietf.org/html/draft-ietf-oauth-mtls-00.html). That work is also valuable to ACE but not all devices will be able to work with certificates or even asymmetric cryptos .

Please review and comment.

Cheers

//Samuel

v2.23.0 | Report a Bug | By Email