IETF Logo Mail Archive

Re: [OAUTH-WG] mistake in draft-ietf-oauth-v2-http-mac-01

William Mills <wmills_92105@yahoo.com> Thu, 09 August 2012 17:53 UTC

Return-Path: <wmills_92105@yahoo.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC30121F8778 for <oauth@ietfa.amsl.com>; Thu, 9 Aug 2012 10:53:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.848
X-Spam-Level:
X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lQhiUOmYD4TR for <oauth@ietfa.amsl.com>; Thu, 9 Aug 2012 10:53:48 -0700 (PDT)
Received: from nm27-vm2.bullet.mail.ne1.yahoo.com (nm27-vm2.bullet.mail.ne1.yahoo.com [98.138.91.215]) by ietfa.amsl.com (Postfix) with SMTP id 1082321F8769 for <oauth@ietf.org>; Thu, 9 Aug 2012 10:53:47 -0700 (PDT)
Received: from [98.138.90.55] by nm27.bullet.mail.ne1.yahoo.com with NNFMP; 09 Aug 2012 17:53:44 -0000
Received: from [98.138.89.251] by tm8.bullet.mail.ne1.yahoo.com with NNFMP; 09 Aug 2012 17:53:44 -0000
Received: from [127.0.0.1] by omp1043.mail.ne1.yahoo.com with NNFMP; 09 Aug 2012 17:53:44 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 948742.78487.bm@omp1043.mail.ne1.yahoo.com
Received: (qmail 42965 invoked by uid 60001); 9 Aug 2012 17:53:44 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1344534823; bh=fJa1imf4M+QVNkiL0kpgek6Bz6VGz/OxQ486NzjTjks=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=gK3HBgy6yfQNnwq747ewxzXv/lxFRte1aLUZ/K6QpvDsuBGeho+BOrYh1/Eq5TDg3oUHWwKq9g4vIjkd6UlVhuR42CQgy6zlMXR3wdiPc45cqvdB7d72mZcdYNofWFn3woAK3TaGTA5Y8kR8wfoHlt9ca8ej5rSx2XEEv4jxzuU=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=lNLfOHbTIqS5HOyRBY+PUXiTjcS1mkFEfRD3U/cP2JqwMLsnPU0+je7wwsTgnKNplFryWHP1WUHsCrah3UkPj10QgFsQg93qHXPaafY2/jyCt14XjQzPn1qPTdMB2Rq4aUKEBnzkqbFeKivYEDFOt6w4bzL8iLHxkuQl+mogSHw=;
X-YMail-OSG: 17CsEk4VM1nrYt1Gv1YBK1bhhKpptIu6q55emlaFmpMfg3T UV0znepws8K5W3m.J9S_UwguMC0DRxuTEm889Xv_3Qy5Vokj6j8pZpDWVFfh RSSRUMvFzySS3vhpwV.gSPxLSLprVleVq1uCzzFGDH6diIe0_oNWKdq0elQ2 qxsQQHj1ECZ3IGJt1hdejbJWTPpXazB32msFcfZs5OLjercv5M_fw.K.m_nO 0D7fu_GBzlWN39v7uK4nWXZPLhTWRbtBijn8OrMDoDRMXmeawj3Y1VKguTRx NcAvOl_75ku_CEg9uhRSmsc2oOXGsImT0rynHpFTha49Yuxu3yodOcxETAiu 76aijgn4JvQCVUg25kV6v78.mPvzHM8mM6zq1t6UZ_.0yz4lPTs.fOBMqE6f VbMnGNTxaMgBa5vBbZZW6HnOSFuqJ5I9iBsjsLYGH.jj86ThtKUwYoKfdtve Et_xWudg2gUXmI5VRxt7VKFppq2.09P53tp3adlvYuMnNcv9yUdH8A0WUjov jlA--
Received: from [209.131.62.115] by web31801.mail.mud.yahoo.com via HTTP; Thu, 09 Aug 2012 10:53:43 PDT
X-Mailer: YahooMailWebService/0.8.120.356233
References: <CAOKdZ1dzVcKBDt6CSLuHwc4NzUVd_hUMWdpJVS6=ncdJo05=UQ@mail.gmail.com> <502280D8.40708@mitre.org> <9AD4EEF7-6187-4A4F-A855-32819BCB8321@gmx.net> <5022D344.40600@mitre.org> <EEBC9705-16C0-4697-8F38-28660C3CB553@ve7jtb.com> <5023CC18.9090809@mitre.org> <1344531175.4871.YahooMailNeo@web31812.mail.mud.yahoo.com> <3940317E-948C-4909-9B8F-2689A6B8D4EB@gmail.com>
Message-ID: <1344534823.39489.YahooMailNeo@web31801.mail.mud.yahoo.com>
Date: Thu, 09 Aug 2012 10:53:43 -0700
From: William Mills <wmills_92105@yahoo.com>
To: Dick Hardt <dick.hardt@gmail.com>
In-Reply-To: <3940317E-948C-4909-9B8F-2689A6B8D4EB@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-368338466-1253285153-1344534823=:39489"
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] mistake in draft-ietf-oauth-v2-http-mac-01
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills_92105@yahoo.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Aug 2012 17:53:49 -0000

MAC fixes the signing problems encountered in OAuth 1.0a, yes there are libraries out there for OAuth 1.0a.  MAC fits in to the OAuth 2 auth model and will provide for a single codepath for sites that want to use both Bearer and MAC.


________________________________
 From: Dick Hardt <dick.hardt@gmail.com>
To: William Mills <wmills_92105@yahoo.com> 
Cc: "oauth@ietf.org" <oauth@ietf.org> 
Sent: Thursday, August 9, 2012 10:27 AM
Subject: Re: [OAUTH-WG] mistake in draft-ietf-oauth-v2-http-mac-01
 



On Aug 9, 2012, at 9:52 AM, William Mills wrote:

I find the idea of starting from scratch frustrating.  MAC solves a set of specific problems and has a well defined use case.  It's symmetric key based which doesn't work for some folks, and the question is do we try to develop something that supports both PK and SK, or finish the SK use case and then work on a PK based draft.
>
>
>I think it's better to leave them separate and finish out MAC which is *VERY CLOSE* to being done.

Who is interested in MAC? People can use OAuth 1.0 if they prefer that model. 

For my projects, I prefer the flexibility of a signed or encrypted JWT if I need holder of key.

Just my $.02

-- Dick  

v2.46.0 | Report a Bug | By Email | System Status