IETF Logo Mail Archive

[OAUTH-WG] Re: Call for adoption: draft-wuertele-oauth-security-topics-update-02 (Ends 2025-10-17)

Tim Würtele <tim.wuertele@sec.uni-stuttgart.de> Tue, 07 October 2025 12:29 UTC

Return-Path: <tim.wuertele@sec.uni-stuttgart.de>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 36CA26E920D9 for <oauth@mail2.ietf.org>; Tue, 7 Oct 2025 05:29:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.295
X-Spam-Level:
X-Spam-Status: No, score=-4.295 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=uni-stuttgart.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7iU4VO4tKiN8 for <oauth@mail2.ietf.org>; Tue, 7 Oct 2025 05:29:23 -0700 (PDT)
Received: from mxex1.tik.uni-stuttgart.de (mxex1.tik.uni-stuttgart.de [129.69.192.20]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E455D6E92048 for <oauth@ietf.org>; Tue, 7 Oct 2025 05:28:52 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mxex1.tik.uni-stuttgart.de (Postfix) with ESMTP id 17C4A60120 for <oauth@ietf.org>; Tue, 07 Oct 2025 14:28:45 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=uni-stuttgart.de; h=content-transfer-encoding:content-type:content-type :in-reply-to:organization:from:from:content-language:references :subject:subject:user-agent:mime-version:date:date:message-id; s=dkim; i=@sec.uni-stuttgart.de; t=1759840123; x=1761578924; bh=iTI0RrYeYZ7Qe7bjQLU0ihRnN2A5tXWfS8ut51/0zJo=; b=gL0Xrwrx8G8+ 9lYGQvPIRfkJg/qQzKJdqThvXTQ3lBBvRMZc+P2jodYfhlHG65njaYOHjB/cs2VL vOzaumtyySODlvCrsoS51XjAwVH0ZKAQjPqw2g2bk00qltGXy2DtRr1iaLsSv4SS PwopDLsm9ITjrFuut7Xw2Ukh0iX2+HzKX7vgYZEgj5hhhlhTXkPFteYU2de3sSsB iIIzS6eT2t8pJI+Y7+AuXIERsfeRNyr2pcjh9M8d36zRZwvX2E0gUqzXUbFoEIeO rn6WGh1roncC0QsuVn/sDJhDjNBQkU4COGE1uuGdEMIXCvc190/gULIqHL+HN/jP Q49g7OXxbA==
X-Virus-Scanned: USTUTT mailrelay AV services at mxex1.tik.uni-stuttgart.de
Received: from mxex1.tik.uni-stuttgart.de ([127.0.0.1]) by localhost (mxex1.tik.uni-stuttgart.de [127.0.0.1]) (amavis, port 10031) with ESMTP id sUAxs4FUqm2s for <oauth@ietf.org>; Tue, 7 Oct 2025 14:28:43 +0200 (CEST)
Received: from authenticated client (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxex1.tik.uni-stuttgart.de (Postfix) with ESMTPSA
Message-ID: <978f2151-319a-4135-9fe9-0994a59fa25c@sec.uni-stuttgart.de>
Date: Tue, 07 Oct 2025 14:28:41 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: oauth@ietf.org
References: <175948921417.3144047.4076367742325628615@dt-datatracker-6c6cdf7f94-h6rnn>
Content-Language: de-DE, en-US
From: Tim Würtele <tim.wuertele@sec.uni-stuttgart.de>
Autocrypt: addr=tim.wuertele@sec.uni-stuttgart.de; keydata= xsFNBF0u4tYBEACjIH1nnCBd8lZiZtJ0UBWpJJzKmOaiJdv268jkdt20EdrzoAjmlvIZuOWh 16J8fkMLy3/Msehgd9RI+P0fmDa4AIp0slpAhLfAAqMjQWjx4SUnYdmOO8FI6XCSDb1vNGuh XOhNHIZAG0D8OHiQGZDC9GYYL/ZBe7WOMJvfqpoy2kvfX2xc3jWsNSzr/Kpl2UL/CvpyVP4S Wq4RKjy+xEWcHrWYKpjPbvTcftB/f6wqop257aGGU3PgEsP2QUgQv9pTJLeClWwzlrQ0CAcO puIR8YnF1fNvkpPimslrIQH5M4tc/uczwXgwSLFDdkW7pUVxokRblCXDOm+17g2OEotqN4h9 LEcUEkpLe57RVVU/HuONCUZnFktqmR7Ld2ZRdOMytirS21Zou61GXDAjdwW2EU1fv1vVI1Bk 8J+fAht0HwHcT/hRcpD5orDAXYwlpYqQmUL4i5fj2tSAR8YO8oNBhBZhm3O3iWD8sp9QMWPk tD1rEJb5EdW8aRi/g22QqG91NG2+apSCUIwxJ1g+XCJDB7zU5Mrs4ScBstaHI4cmGLXIgcMZ m24lrEkN/Tj/KiDyslWQfKziTNAc2i3hNZPoP+h2ykE0QWRTzN3RRSNjC82KpcgbBRkGBVCY hVUMBHFG1dyn6c/bfiojO35xynpZmvt29dRwdksGJAu+A5bNfwARAQABzTBUaW0gV8O8cnRl bGUgPHRpbS53dWVydGVsZUBzZWMudW5pLXN0dXR0Z2FydC5kZT7CwZQEEwEIAD4WIQRglwh7 cst2TwXzN+i+Pjz9/xP60QUCZeGhDwIbIwUJDHSQmgULCQgHAgYVCgkICwIEFgIDAQIeAQIX gAAKCRC+Pjz9/xP60YIWD/9ZKZfU4jRglw5hc9I7BYIZ6QmGLEPS9+DirFsRAxKW9fNk6mWT aX5qBKC/GL3lMRyYLYWAZb2PiKDHsaaN/qKNVrDdQgxOKyT1xz/nAKHtPPySmSU3diO94ZD8 T7vKBw6WkUzZTiw7P6/BDF34FvJ84LNiRDaJmHITkoG/STmXzFXZ+OCtorWgk5Jm1z52P57M +/9o1grlHJuVxXMhdf291ynxtC+JzKUCkSACOrkbRAiCMCN+PawboJAqMelX63O+xLR9Q2mg Q8TMr3mYFXfuDTX4cZuSN+hJRfFntCFJ5i79DOks5HJC6o5rMPVrF4tamxCpORwGUPyZmF+8 RcMYS3DT0XvIC3YfBaj9zvFDizSMahb+gbNiULXUHwBhsGJPlrGv74TYe0U2lGgnrjFPGOBd 2/4bd3EQmhvLA1v7NdzujoVIToWX46SYM4he8lvU37c/3sq4IUhOimBbAMg5o5oZnopnHGFi K10g4k2qTGqfCKUspc+iifL4vKQxkG421GTg31Q1N0WaCC7o72N3gnFYuw/adWYs3t3+Igd7 Ic11659J1LTYwEhPx6P8uIntZ2AptucBaVLtZUnmxSi0U8iom+6Jo093HFKqjQJKm4h3U0wc rZVOermhvNV96tPwGIf7co0N4Oor24JQAMpe0e3VqdQc8y2R+2CX1W81Ec7BTQRdLuLWARAA 2UJZNJAN8d/eCvCbHIQ98Wq0ZjjT+X5vKrZ0CPtr6qkKxTVtM/pznRCQLlfBA7Aw75304Tk0 mQxcjc48Yvrlow0G1vWAiBAEXqY0DTF19WnrUTWomiQZ2xXC099viaEqD6dNmzElTUbQjQkv FPz7U0YU9JHsT3/tdwmoRqGUT8qzx6lFNXiscN6hTrxnLvVSlgZcLw7jk6cVIoe/U7sS8FPq RhqBW2K+9Lhz2vNqGgzUZHhk+ACtOTioHQeiUc8I/tbtzmIOSix1LfkNoBR7eNQZN+kj5RPh KZkRbwKz7PT//N01gWCHv3MdTKMFpPP0mSvCp9AhnMxpUMm29MdFsXb1U+DFPTerssbUlssU fe2qJP4/khOvYrOH17hiWPt8axUKlpoTIAvs9ZoEj9rI5+ReCn1Kty2kqeIaiGASkGXVmVmD VDhYS5JaGjpSRDtyLM96ra106BOr20kFWjbgBPOzEQm/YduWutbaE2vkI8Nzm4d4ESgyCNHa SKvm4YHkxzQib2iflWZV3+siC3StFmNS6i56DKcpQ5LdsUpHkZp7kw27BeGXyWzw5Y2Hh4px Hg+igMNGRxBZHkqvKJ/lur1k302jBHwhJN6m4BSLNiEP/UXaC44RtEIKZmFrKuNmkV0IqSO/ jbS8VFRwf7Ga4CGgVFSxOgKe9ulyEJnwAcsAEQEAAcLBfAQYAQgAJhYhBGCXCHtyy3ZPBfM3 6L4+PP3/E/rRBQJl4aEPAhsMBQkMdJCaAAoJEL4+PP3/E/rRb0MP/2UYLFFNRbpxG7lBg9LE fLdhqKneE/N3iSBA4yApZ2i/VC183DiTjS8nIy7ESh4ABLpw8MKDCvKW2uGB2NOk+sRlKg74 PpvjiQ4fZoBLUBOLFlQLB63AlFyyezefu27xP8IzhjpJWj0X+4RoeAi2PDKJpYZxa/pDLiAe 8mr5MXiU1mdKUSW7nA0F/8TaRPKrZCxdlrLVHxTLfiZUftB7PBFtULcTZMgYAr/bRGiw2bVt MZDCq0jvmNp7p40kzmGGegjgqtiDW8TaLX11ZKnZQY6ik1OzwprofZQt08Da8sPxlqsBTM87 x2BDr/w0m0WqPB8PQTsXZb+R2is0bz6oyP+oEL/hCAOdfuYoCOLrmVz7DOTxe0O9pqVbqblQ bjDScHSIk2Ndjbf47v5rpOuI2zLhwOyMlQOlbiNA0dbSyysoc1Azh09n+CJX+f0tygEyvxpB EIEFNPYTtyi4WfSEm9Nt8xfrIYYRcOdiVl5S/9xqDvsGFcoexVLzgXHqx93Lr6wvI2dd+jE/ yOuoGvjIf+6SIkQtUkxjTaFT4q5N28J9v9ufxQUZMWWNzDegEU8EkVHkg8tJeExHud26olOg ptQIJ8NUDjvXWqGg2NBIFqPKU23GWf/82GMvi2sp4uAsSKezpLzhc/+c3WnqxsRNyCqkqzdj chTyaNgszjljYMd4
Organization: SEC - Uni Stuttgart
In-Reply-To: <175948921417.3144047.4076367742325628615@dt-datatracker-6c6cdf7f94-h6rnn>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Message-ID-Hash: GLG7YEYZTQT2FIXF3UNBRBGXECHNNWBQ
X-Message-ID-Hash: GLG7YEYZTQT2FIXF3UNBRBGXECHNNWBQ
X-MailFrom: tim.wuertele@sec.uni-stuttgart.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Re: Call for adoption: draft-wuertele-oauth-security-topics-update-02 (Ends 2025-10-17)
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/EX2S9YeRgzmJrF6svwKTvFuIPd4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

Thank you for considering adoption, which I (somewhat unsurprisingly) 
support :)

On 03.10.25 13:00, Rifaat Shekh-Yusef via Datatracker wrote:
> Subject: Call for adoption: draft-wuertele-oauth-security-topics-update-02
> (Ends 2025-10-17)
>
> This message starts a 2-week Call for Adoption for this document.
>
> Abstract:
>     This document updates the set of best current security practices for
>     OAuth 2.0 by extending the security advice given in RFC 6749, RFC
>     6750, and RFC 9700, to cover new threats that have been discovered
>     since the former documents have been published.
>
> File can be retrieved from:
> https://datatracker.ietf.org/doc/draft-wuertele-oauth-security-topics-update/
>
> Please reply to this message keeping oauth@ietf.org in copy by indicating
> whether you support or not the adoption of this draft as a WG document.
> Comments to motivate your preference are highly appreciated.
>
> Authors, and WG participants in general, are reminded of the Intellectual
> Property Rights (IPR) disclosure obligations described in BCP 79 [2].
> Appropriate IPR disclosures required for full conformance with the provisions
> of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
> Sanctions available for application to violators of IETF IPR Policy can be
> found at [3].
>
> Thank you.
> [1] https://datatracker.ietf.org/doc/bcp78/
> [2] https://datatracker.ietf.org/doc/bcp79/
> [3] https://datatracker.ietf.org/doc/rfc6701/
>
>
>
-- 
Tim Würtele, M.Sc.
Room V38 2.434
Institute of Information Security - SEC
Universität Stuttgart
Universitätsstraße 38
D-70569 Stuttgart
Germany
Phone: +49 (0) 711 685-88468
https://sec.uni-stuttgart.de

v2.46.0 | Report a Bug | By Email | System Status