Re: [OAUTH-WG] draft-ietf-oauth-v2-http-mac

Hi Hannes, All,

Thanks for the update.

I asked last time but did not get an answer:
- why the use of access token is mandated to be 'conditional' - if you 
think I need to read the text more carefully, then please do not 
hesitate to say so :-), I'll give it a try

- Reading "Session Key Transport to Resource Server" section makes me 
nervous. May be I'm missing the point, but I wonder, what happened to 
that draft which had a chance to go mainstream ? Do editors target a new 
MAC token at large OAuth2 implementers only ? It appears to me the focus 
is more on getting JWT more recognized as opposed to making a simple MAC 
scheme working...I'm sorry if I sound like I've no clue what I'm talking 
about, but please make this section read such that people can implement 
the scheme without having to know what JWT or a dynamic introspection 
mechanism is

Best Regards
Sergey

On 15/07/13 18:29, Hannes Tschofenig wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi all,
>
> we have submitted an update to the MAC token document. From the changes to the previous version you will see that we have incorporated text written during the design team discussions earlier this year into the appendix. I hope that this provides additional background about the threats, use cases, and security requirements. Phil has joined us as a co-author (since he was heavily involved in the work on the incorporated text).
>
> There is, however, still work to be done. The body of the document still needs a lot of work to get the specification to level of detail that we can start the WGLC.
>
> Anyway, here is the updated  document:
> https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-http-mac
>
> Ciao
> Hannes
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iQEcBAEBCgAGBQJR5DF6AAoJEGhJURNOOiAtD1YIAKZYojwcZ1H8MqWtvJTv9/81
> YLIW7kUraNlwUelTRu4WoakYDGmcG8gPHr4LjbVWhhtcSOIHqDsEYeCuEqPTBPbZ
> Gv5tG7B5SKS7Cn540f5ZVGNsIhGqSdpBpdRau2o8WKlD3HwgOHKeLgBfhF7fkWhc
> 3xDo2lS3Q6khwPW2VrnP1fpUS2vs2sMq+zWBYwk0+onHcdSVsonF0+gPkg0aaXnO
> gMZML5KecISt7UHI8r4ZduCkPq1Hhk3Rdp7XW3KOnJRO1DNeShjI20k52sU6Y33Q
> mmATLQoqyb9ld2gZIspS3w0eGfKkO843ImwTCjtLMHWH50rYGuv0oue5Lf0x0n8=
> =fDtL
> -----END PGP SIGNATURE-----
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>