Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

Mike Jones <> Thu, 03 April 2014 18:32 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 92B5B1A0245 for <>; Thu, 3 Apr 2014 11:32:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 8o67wPikx_DB for <>; Thu, 3 Apr 2014 11:32:40 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 8639C1A028D for <>; Thu, 3 Apr 2014 11:32:35 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.913.9; Thu, 3 Apr 2014 18:32:28 +0000
Received: from (2a01:111:f400:7c09::104) by (2a01:111:e400:2c5d::19) with Microsoft SMTP Server (TLS) id 15.0.913.9 via Frontend Transport; Thu, 3 Apr 2014 18:32:28 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.908.10 via Frontend Transport; Thu, 3 Apr 2014 18:32:28 +0000
Received: from ([]) by ([]) with mapi id 14.03.0174.002; Thu, 3 Apr 2014 18:31:52 +0000
From: Mike Jones <>
To: John Bradley <>, Phil Hunt <>
Thread-Topic: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt
Thread-Index: AQHPT1olpQMLkHf4/kC3w3flBp/HH5sAF2eAgAABEICAABi7AIAABazQ
Date: Thu, 03 Apr 2014 18:31:52 +0000
Message-ID: <>
References: <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739439A139FC3TK5EX14MBXC286r_"
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009001)(438001)(377424004)(189002)(199002)(377454003)(24454002)(479174003)(81542001)(15974865002)(86362001)(512954002)(98676001)(97736001)(47976001)(74706001)(79102001)(74502001)(74876001)(94316002)(92726001)(81816001)(71186001)(15188155005)(93516002)(93136001)(47446002)(77982001)(15395725003)(47736001)(81342001)(44976005)(76482001)(85852003)(56776001)(55846006)(56816005)(6806004)(15975445006)(54316002)(83072002)(19580405001)(84676001)(76786001)(2009001)(15202345003)(83322001)(59766001)(87936001)(33656001)(92566001)(63696002)(2656002)(81686001)(85806002)(4396001)(86612001)(95416001)(80976001)(49866001)(90146001)(31966008)(77096001)(53806001)(54356001)(74366001)(97336001)(80022001)(76796001)(66066001)(69226001)(19300405004)(14971765001)(95666003)(16297215004)(50986001)(19580395003)(74662001)(99396002)(85306002)(97186001)(84326002)(46102001)(65816001)(87266001)(51856001)(19623215001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR03MB028;; FPR:A84FFD3D.ACF677CC.B7C37F4B.52E4C9B1.20471; MLV:sfv; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en;
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 0170DAF08C
Received-SPF: Pass (: domain of designates as permitted sender) receiver=; client-ip=;;
Cc: "" <>
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 03 Apr 2014 18:32:44 -0000

I agree with what John wrote below.  Besides, PoP is more natural to say than HoK and certainly more natural to say than HOTK.  I'd like us to stay with the term Proof-of-Possession (PoP).

                                                            -- Mike

From: OAuth [] On Behalf Of John Bradley
Sent: Thursday, April 03, 2014 11:10 AM
To: Phil Hunt
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

Some people and specs associate holder of key with asymmetric keys.  Proof of possession is thought to be a broader category including symmetric and key agreement eg

NIST defines the term PoP Protocol

In SAML the saml:SubjectConfirmation method  is called urn:oasis:names:tc:SAML:2.0:cm:holder-of-key

In WS* the term proof of possession is more common.

So I think for this document as an overview "Proof of Possession (PoP) Architecture" is fine.

John B.

On Apr 3, 2014, at 12:41 PM, Phil Hunt <<>> wrote:

What was wrong with HOK?

Aside: Why was "the" so important in HOTK?



On Apr 3, 2014, at 9:37 AM, Anil Saldhana <<>> wrote:

  why not just use "proof"?


Is that allowed by IETF?


On 04/03/2014 11:30 AM, Prateek Mishra wrote:
"key confirmed" or "key confirmation" is another term that is widely used for these use-cases

I really *like* the name "proof of possession", but I think the acronym PoP is going to be confused with POP.  HOTK has the advantage of not being a homonym for aything else.  What about "Possession Proof"?


William J. Mills
"Paranoid" MUX Yahoo!

On Thursday, April 3, 2014 1:38 AM, ""<> <><> wrote:

A new version of I-D, draft-hunt-oauth-pop-architecture-00.txt
has been successfully submitted by Hannes Tschofenig and posted to the
IETF repository.

Name:        draft-hunt-oauth-pop-architecture
Revision:    00
Title:        OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
Document date:    2014-04-03
Group:        Individual Submission
Pages:        21

  The OAuth 2.0 bearer token specification, as defined in RFC 6750,
  allows any party in possession of a bearer token (a "bearer") to get
  access to the associated resources (without demonstrating possession
  of a cryptographic key).  To prevent misuse, bearer tokens must to be
  protected from disclosure in transit and at rest.

  Some scenarios demand additional security protection whereby a client
  needs to demonstrate possession of cryptographic keying material when
  accessing a protected resource.  This document motivates the
  development of the OAuth 2.0 proof-of-possession security mechanism.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at<>.

The IETF Secretariat

OAuth mailing list<>

OAuth mailing list<>