Re: [OAUTH-WG] HOTK/POP/etc drafts

Hannes Tschofenig <hannes.tschofenig@gmx.net> Thu, 24 April 2014 19:46 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B41181A037A for <oauth@ietfa.amsl.com>; Thu, 24 Apr 2014 12:46:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.172
X-Spam-Level:
X-Spam-Status: No, score=-2.172 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oTUrwYvOyy61 for <oauth@ietfa.amsl.com>; Thu, 24 Apr 2014 12:46:08 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id 054831A0383 for <oauth@ietf.org>; Thu, 24 Apr 2014 12:46:08 -0700 (PDT)
Received: from [192.168.131.128] ([80.92.122.106]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0MJWAZ-1WbTmm2RuV-0037Lk; Thu, 24 Apr 2014 21:45:59 +0200
Message-ID: <5359691E.5000807@gmx.net>
Date: Thu, 24 Apr 2014 21:42:22 +0200
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: Lewis Adam-CAL022 <Adam.Lewis@motorolasolutions.com>, "oauth@ietf.org" <oauth@ietf.org>
References: <a5902fbd6bf44b5bb03d9ebf6da0bc33@DM2PR04MB735.namprd04.prod.outlook.com> <53593E65.5020903@gmx.net>
In-Reply-To: <53593E65.5020903@gmx.net>
X-Enigmail-Version: 1.5.2
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="V2ifseBb6lkdE75Ce7efEa4pkUmospnaw"
X-Provags-ID: V03:K0:ePcXPrwjUkQjlvovikurcaiP+lAzBj9VJqoklrrtm1PTbTt23gZ yfcB65k973xEcJkuIfp8p78Pmbcx6mZcBKjGn16SyM9uO3w4e5NECNK4TJ9tL7murA+mIU3 /YA8V7vJQi9kJ4oKN21imj6hZpk/Sej0FDo3JekeY5PIfZidA3DHpg0JR5LeYhv2rBE3AXS c6NWDibUA5f7EpT2z5ZQA==
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/74h_31izoavoRB5Ng09str5NbOA
Subject: Re: [OAUTH-WG] HOTK/POP/etc drafts
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Apr 2014 19:46:11 -0000

Btw, the HTTP signature mechanism now also got published as
http://tools.ietf.org/html/draft-richer-oauth-signed-http-request-01

I think we now have a pretty good collection of documents to look at.

Ciao
Hannes


On 04/24/2014 06:40 PM, Hannes Tschofenig wrote:
> Hi Lewis,
> 
> good that you ask.
> 
> In the London IETF meeting we have proposed a plan on how to proceed
> with the proof-of-possession (PoP) work.
> 
> John had already explained that the main document is
> draft-hunt-oauth-pop-architecture-00. It pains the big picture and
> points to the relevant documents, in particular to
>  a) draft-bradley-oauth-pop-key-distribution
>  b) draft-jones-oauth-proof-of-possession
>  c) a not-yet-published HTTP signature mechanism.
> 
> (a) explains how the client obtains keys from the authorization server.
> (b) describes a mechanism for binding a key to the access token.
> (c) illustrates the procedure for the client to interact with the
> resource server (based on the PoP mechanism).
> 
> These documents replace prior work on draft-ietf-oauth-v2-http-mac-05
> and draft-tschofenig-oauth-hotk-03.
> 
> We are getting closer to have all relevant parts published.
> 
> Ciao
> Hannes
> 
> On 04/24/2014 05:14 PM, Lewis Adam-CAL022 wrote:
>> Hi,
>>
>>  
>>
>> Lots of crypto drafts on OAuth popping up that I need to come up to
>> speed on.
>>
>> draft-bradley-oauth-pop-key-distribution-00
>> <http://datatracker.ietf.org/doc/draft-bradley-oauth-pop-key-distribution/>
>>
>> draft-hunt-oauth-pop-architecture-00
>> <http://datatracker.ietf.org/doc/draft-hunt-oauth-pop-architecture/>
>>
>> draft-jones-oauth-proof-of-possession-00
>> <http://datatracker.ietf.org/doc/draft-jones-oauth-proof-of-possession/>
>>
>> draft-sakimura-oauth-rjwtprof-01
>> <http://datatracker.ietf.org/doc/draft-sakimura-oauth-rjwtprof/>
>>
>> draft-sakimura-oauth-tcse-03
>> <http://datatracker.ietf.org/doc/draft-sakimura-oauth-tcse/>
>>
>> draft-tschofenig-oauth-hotk-03
>> <http://datatracker.ietf.org/doc/draft-tschofenig-oauth-hotk/>
>>
>>  
>>
>> Glad to see all the work, but is there a preferred reading order here? 
>> Which ones build on each other vs. which ones are out there on their own?
>>
>>  
>>
>>  
>>
>> -adam
>>
>>
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
> 
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>