[OAUTH-WG] New Draft: OAuth 2.0 Security BCP Update

[OAUTH-WG] New Draft: OAuth 2.0 Security BCP Update - Request for Early Feedback

Tim Würtele <tim.wuertele@sec.uni-stuttgart.de> Tue, 17 June 2025 04:40 UTC

Message-ID: <a5efe7a9-5902-4ab8-81c5-d0837138a606@sec.uni-stuttgart.de>
Date: Tue, 17 Jun 2025 06:40:05 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: de-DE, en-US
From: Tim Würtele <tim.wuertele@sec.uni-stuttgart.de>
Autocrypt: addr=tim.wuertele@sec.uni-stuttgart.de; keydata= xsFNBF0u4tYBEACjIH1nnCBd8lZiZtJ0UBWpJJzKmOaiJdv268jkdt20EdrzoAjmlvIZuOWh 16J8fkMLy3/Msehgd9RI+P0fmDa4AIp0slpAhLfAAqMjQWjx4SUnYdmOO8FI6XCSDb1vNGuh XOhNHIZAG0D8OHiQGZDC9GYYL/ZBe7WOMJvfqpoy2kvfX2xc3jWsNSzr/Kpl2UL/CvpyVP4S Wq4RKjy+xEWcHrWYKpjPbvTcftB/f6wqop257aGGU3PgEsP2QUgQv9pTJLeClWwzlrQ0CAcO puIR8YnF1fNvkpPimslrIQH5M4tc/uczwXgwSLFDdkW7pUVxokRblCXDOm+17g2OEotqN4h9 LEcUEkpLe57RVVU/HuONCUZnFktqmR7Ld2ZRdOMytirS21Zou61GXDAjdwW2EU1fv1vVI1Bk 8J+fAht0HwHcT/hRcpD5orDAXYwlpYqQmUL4i5fj2tSAR8YO8oNBhBZhm3O3iWD8sp9QMWPk tD1rEJb5EdW8aRi/g22QqG91NG2+apSCUIwxJ1g+XCJDB7zU5Mrs4ScBstaHI4cmGLXIgcMZ m24lrEkN/Tj/KiDyslWQfKziTNAc2i3hNZPoP+h2ykE0QWRTzN3RRSNjC82KpcgbBRkGBVCY hVUMBHFG1dyn6c/bfiojO35xynpZmvt29dRwdksGJAu+A5bNfwARAQABzTBUaW0gV8O8cnRl bGUgPHRpbS53dWVydGVsZUBzZWMudW5pLXN0dXR0Z2FydC5kZT7CwZQEEwEIAD4WIQRglwh7 cst2TwXzN+i+Pjz9/xP60QUCZeGhDwIbIwUJDHSQmgULCQgHAgYVCgkICwIEFgIDAQIeAQIX gAAKCRC+Pjz9/xP60YIWD/9ZKZfU4jRglw5hc9I7BYIZ6QmGLEPS9+DirFsRAxKW9fNk6mWT aX5qBKC/GL3lMRyYLYWAZb2PiKDHsaaN/qKNVrDdQgxOKyT1xz/nAKHtPPySmSU3diO94ZD8 T7vKBw6WkUzZTiw7P6/BDF34FvJ84LNiRDaJmHITkoG/STmXzFXZ+OCtorWgk5Jm1z52P57M +/9o1grlHJuVxXMhdf291ynxtC+JzKUCkSACOrkbRAiCMCN+PawboJAqMelX63O+xLR9Q2mg Q8TMr3mYFXfuDTX4cZuSN+hJRfFntCFJ5i79DOks5HJC6o5rMPVrF4tamxCpORwGUPyZmF+8 RcMYS3DT0XvIC3YfBaj9zvFDizSMahb+gbNiULXUHwBhsGJPlrGv74TYe0U2lGgnrjFPGOBd 2/4bd3EQmhvLA1v7NdzujoVIToWX46SYM4he8lvU37c/3sq4IUhOimBbAMg5o5oZnopnHGFi K10g4k2qTGqfCKUspc+iifL4vKQxkG421GTg31Q1N0WaCC7o72N3gnFYuw/adWYs3t3+Igd7 Ic11659J1LTYwEhPx6P8uIntZ2AptucBaVLtZUnmxSi0U8iom+6Jo093HFKqjQJKm4h3U0wc rZVOermhvNV96tPwGIf7co0N4Oor24JQAMpe0e3VqdQc8y2R+2CX1W81Ec7BTQRdLuLWARAA 2UJZNJAN8d/eCvCbHIQ98Wq0ZjjT+X5vKrZ0CPtr6qkKxTVtM/pznRCQLlfBA7Aw75304Tk0 mQxcjc48Yvrlow0G1vWAiBAEXqY0DTF19WnrUTWomiQZ2xXC099viaEqD6dNmzElTUbQjQkv FPz7U0YU9JHsT3/tdwmoRqGUT8qzx6lFNXiscN6hTrxnLvVSlgZcLw7jk6cVIoe/U7sS8FPq RhqBW2K+9Lhz2vNqGgzUZHhk+ACtOTioHQeiUc8I/tbtzmIOSix1LfkNoBR7eNQZN+kj5RPh KZkRbwKz7PT//N01gWCHv3MdTKMFpPP0mSvCp9AhnMxpUMm29MdFsXb1U+DFPTerssbUlssU fe2qJP4/khOvYrOH17hiWPt8axUKlpoTIAvs9ZoEj9rI5+ReCn1Kty2kqeIaiGASkGXVmVmD VDhYS5JaGjpSRDtyLM96ra106BOr20kFWjbgBPOzEQm/YduWutbaE2vkI8Nzm4d4ESgyCNHa SKvm4YHkxzQib2iflWZV3+siC3StFmNS6i56DKcpQ5LdsUpHkZp7kw27BeGXyWzw5Y2Hh4px Hg+igMNGRxBZHkqvKJ/lur1k302jBHwhJN6m4BSLNiEP/UXaC44RtEIKZmFrKuNmkV0IqSO/ jbS8VFRwf7Ga4CGgVFSxOgKe9ulyEJnwAcsAEQEAAcLBfAQYAQgAJhYhBGCXCHtyy3ZPBfM3 6L4+PP3/E/rRBQJl4aEPAhsMBQkMdJCaAAoJEL4+PP3/E/rRb0MP/2UYLFFNRbpxG7lBg9LE fLdhqKneE/N3iSBA4yApZ2i/VC183DiTjS8nIy7ESh4ABLpw8MKDCvKW2uGB2NOk+sRlKg74 PpvjiQ4fZoBLUBOLFlQLB63AlFyyezefu27xP8IzhjpJWj0X+4RoeAi2PDKJpYZxa/pDLiAe 8mr5MXiU1mdKUSW7nA0F/8TaRPKrZCxdlrLVHxTLfiZUftB7PBFtULcTZMgYAr/bRGiw2bVt MZDCq0jvmNp7p40kzmGGegjgqtiDW8TaLX11ZKnZQY6ik1OzwprofZQt08Da8sPxlqsBTM87 x2BDr/w0m0WqPB8PQTsXZb+R2is0bz6oyP+oEL/hCAOdfuYoCOLrmVz7DOTxe0O9pqVbqblQ bjDScHSIk2Ndjbf47v5rpOuI2zLhwOyMlQOlbiNA0dbSyysoc1Azh09n+CJX+f0tygEyvxpB EIEFNPYTtyi4WfSEm9Nt8xfrIYYRcOdiVl5S/9xqDvsGFcoexVLzgXHqx93Lr6wvI2dd+jE/ yOuoGvjIf+6SIkQtUkxjTaFT4q5N28J9v9ufxQUZMWWNzDegEU8EkVHkg8tJeExHud26olOg ptQIJ8NUDjvXWqGg2NBIFqPKU23GWf/82GMvi2sp4uAsSKezpLzhc/+c3WnqxsRNyCqkqzdj chTyaNgszjljYMd4
Organization: SEC - Uni Stuttgart
To: oauth@ietf.org
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Message-ID-Hash: XDBKJPHO7VVNPZRMB56INKUUS3EQKDG7
CC: kaixuan@ie.cuhk.edu.hk, adonis.fung@samsung.com
Precedence: list
Subject: [OAUTH-WG] New Draft: OAuth 2.0 Security BCP Update - Request for Early Feedback
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/IxJAbaM7qOePnf9UonwDoWEvmcs>

Dear OAuth WG,

We've just published a new I-D 
draft-wuertele-oauth-security-topics-update-01 to update RFC 9700 [1]. 
As briefly discussed and agreed upon at IETF 122 [2], since the 
publication of RFC 9700, two new classes of attacks have been discovered 
that warrant updates to the current best practices:

- Audience Injection Attacks, which have been presented and discussed in 
the January interim meeting [3], and at OSW 2025.
- New Mix-Up Variants, which were presented and discussed in depth at 
OSW 2025 [4], and with the original RFC 9700 authors.

We would like to kindly invite the working group to review this draft 
and provide early feedback, especially on Section 2, which contains the 
newly identified attacks and corresponding defenses.

The draft is still in an early state and not yet fully polished, but we 
are very interested in receiving any feedback at this stage, and in 
particular on the following points:

- Does the structure of Section 2 make sense overall?
- Are the attack descriptions in Section 2 clear and sufficient to 
understand the threats?
- Are the defense descriptions understandable and actionable?
- What should be the title of this document? There already is some 
discussion on this in issue #1 [5].
- Which existing RFCs should this document formally update (beyond RFC 
9700)? See also issue #4 [6].

Feedback is very welcome both on the mailing list and as GitHub issues 
(including comments/thoughts on the existing issues).

Looking forward to your thoughts and feedback!

Best regards,
Pedram, Kaixuan, Adonis, and Tim

[1] 
https://datatracker.ietf.org/doc/draft-wuertele-oauth-security-topics-update
[2] 
https://datatracker.ietf.org/doc/minutes-122-oauth-202503180600/#updating-security-bcp---pedram-hosseyni-10-min
[3] https://datatracker.ietf.org/meeting/interim-2025-oauth-04/session/oauth
[4] https://talks.secworkshop.events/osw2025/talk/WG9TEW
[5] 
https://github.com/SECtim/draft-wuertele-oauth-security-topics-update/issues/1
[6] 
https://github.com/SECtim/draft-wuertele-oauth-security-topics-update/issues/4

[OAUTH-WG] New Draft: OAuth 2.0 Security BCP Upda… Tim Würtele