[OAUTH-WG] Alternatives to unverified key sharing

Watson Ladd <watsonbladd@gmail.com> Tue, 10 June 2025 21:31 UTC

MIME-Version: 1.0
From: Watson Ladd <watsonbladd@gmail.com>
Date: Tue, 10 Jun 2025 14:30:54 -0700
Message-ID: <CACsn0ckzOXW7XLELD+D0C3h7M9MDbQQmC7=MESjU44Tnm=m_Lg@mail.gmail.com>
To: IETF oauth WG <oauth@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Message-ID-Hash: Q3YGHBUWSTP34QKI7SGRHGBQ4NKO3AND
Precedence: list
Subject: [OAUTH-WG] Alternatives to unverified key sharing
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/FgqTykDaGvRxy79jKYOGP08ngyA>

Dear ouath WG,

I watched the Bangkok presentation and I think that the problem
presented as motivation really has better solutions, or maybe I didn't
quite understand it.

As I understand it the issue is that we have a client that needs an
oauth token where the fields are dynamically produced as a result of
one coming in, and the client doesn't know how to get one. I think it
would be safer to have the auxiliary process produce a grant to an
existing token that the client does have where proof of possession of
the key already exists via chaining, akin to how we can use
intermediates in X509. This avoids the issues with unknown key share
that are an unfixable issue with the current proposal.

Sincerely,
Watson

-- 
Astra mortemque praestare gradatim

[OAUTH-WG] Alternatives to unverified key sharing Watson Ladd