Re: [OAUTH-WG] why are we signing?

[John Kemp <[e-mail]>]

On Nov 9, 2009, at 12:02 AM, Brian Eaton wrote:

[...]

>
> My guess is we need at least two out of those four choices (one with
> bearer tokens, a la OAuth 1.0 plaintext) and another with
> cryptography.  But I'm not sure whether we need to sign entire
> messages, or if we can get away with something simpler and still have
> reasonable security.

I agree that bearer tokens are useful.

As for signatures, the question is really all in the subject line. And  
I guess the answers I would come up with, generally-speaking would be:

i) To authenticate the entity doing the signing, by means of the use  
and verification of that entity's key. Such authentication can be a  
basis for authorizing that entity via the presence of the token in the  
message to do whatever is asked for in the request message.
ii) To bind the token and the rest of the message together to ensure  
that the recipient can detect whether the (important parts of the)  
message was tampered with by a third-party.

If we are only interested in i) then signing any piece of the message  
might be sufficient. If we are interested in ii) (or some other  
security property) then we will need to identify which pieces of the  
message we want to provide that, or other, security properties for.

- johnk