IETF Logo Mail Archive

Re: [OAUTH-WG] mistake in draft-ietf-oauth-v2-http-mac-01

Justin Richer <jricher@mitre.org> Wed, 08 August 2012 15:09 UTC

Return-Path: <jricher@mitre.org>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C40A021F8670 for <oauth@ietfa.amsl.com>; Wed, 8 Aug 2012 08:09:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.556
X-Spam-Level:
X-Spam-Status: No, score=-6.556 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a-C4deoQMqiZ for <oauth@ietfa.amsl.com>; Wed, 8 Aug 2012 08:09:25 -0700 (PDT)
Received: from smtpksrv1.mitre.org (smtpksrv1.mitre.org [198.49.146.77]) by ietfa.amsl.com (Postfix) with ESMTP id 1B7C421F84F5 for <oauth@ietf.org>; Wed, 8 Aug 2012 08:09:25 -0700 (PDT)
Received: from smtpksrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 2036921B1AEA for <oauth@ietf.org>; Wed, 8 Aug 2012 11:09:24 -0400 (EDT)
Received: from IMCCAS03.MITRE.ORG (imccas03.mitre.org [129.83.29.80]) by smtpksrv1.mitre.org (Postfix) with ESMTP id 1023521B0845 for <oauth@ietf.org>; Wed, 8 Aug 2012 11:09:24 -0400 (EDT)
Received: from [129.83.50.26] (129.83.31.51) by IMCCAS03.MITRE.ORG (129.83.29.80) with Microsoft SMTP Server (TLS) id 14.2.309.2; Wed, 8 Aug 2012 11:09:23 -0400
Message-ID: <502280D8.40708@mitre.org>
Date: Wed, 08 Aug 2012 11:08:08 -0400
From: Justin Richer <jricher@mitre.org>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20120714 Thunderbird/14.0
MIME-Version: 1.0
To: oauth@ietf.org
References: <CAOKdZ1dzVcKBDt6CSLuHwc4NzUVd_hUMWdpJVS6=ncdJo05=UQ@mail.gmail.com>
In-Reply-To: <CAOKdZ1dzVcKBDt6CSLuHwc4NzUVd_hUMWdpJVS6=ncdJo05=UQ@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [129.83.31.51]
Subject: Re: [OAUTH-WG] mistake in draft-ietf-oauth-v2-http-mac-01
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Aug 2012 15:09:25 -0000

Thanks Justas. The MAC document is currently without an editor within 
the WG, so this is the best place to record the error.

A wider note to the WG: I wouldn't mind taking over editorship of the 
MAC token document so long as I could get a co-editor with enough 
cryptographic expertise to make sure all the magical crypto bits work 
like they should. I've sent an email to the chairs saying as much, as well.

  -- Justin

On 08/05/2012 06:30 AM, Justas Janauskas wrote:
> Hello,
>
> Sorry if this is not the right group to send this message; I am new here.
>
> I believe there is mistake in calculated request MAC presented in
> "draft-ietf-oauth-v2-http-mac-01" example, section 1.1.
>
> I made a small program to test correctness of an example and it shows
> that it is incorrectly calculated in the document:
> https://gist.github.com/3263677
>
> I have also implemented an example from previous draft 00, section 1.2
> which shows that request MAC is calculated correctly there:
> https://gist.github.com/3263765
>
> Thank you,
> Justas Janauskas
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.46.0 | Report a Bug | By Email | System Status