[OAUTH-WG] HTTP Signing

Justin Richer <jricher@mit.edu> Mon, 20 January 2020 16:51 UTC

From: Justin Richer <jricher@mit.edu>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Message-Id: <6589BCE0-7710-4E2C-8E41-73BC28F8BCCA@mit.edu>
Date: Mon, 20 Jan 2020 11:51:34 -0500
To: oauth <oauth@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/6NrcMRwxiux4M8_-Mz_r6HZLWAY>
Subject: [OAUTH-WG] HTTP Signing
Precedence: list

As many of you know, Annabelle and I have put forward a general-purpose HTTP Signing specification in the HTTP Working Group, at least initially based on the old Cavage signatures spec that’s been used in the wild. We expect a number of important changes to happen as it goes through the standards process (which is to say, we aren’t approaching this to get a stamp on existing code), including some key things that would allow it to be used for more advanced OAuth proof of possession work. I would fully expect that a fairly small profile of this new signature document would be sufficient for OAuth PoP tokens, replacing the expired draft-ietf-http-signatures spec. 

As I said in Singapore, I think that there’s room for this kind of thing alongside DPoP, which is much more focused and constrained than this is trying to be. 

The new draft is currently going through its call for adoption within the HTTP WG, and if you have any interest in this work moving forward, please join the thread on the HTTP list to show your support for the draft. The Call For Adoption is currently open and runs through Jan 31.

Thanks,
 — Justin

[OAUTH-WG] HTTP Signing Justin Richer