IETF Logo Mail Archive

[OAUTH-WG] Re: New Draft: draft-williams-oauth-poi-core-00 (Proof-of-Intent Core)

Mohamad Khalil Yossif <mohamad@yuthent.com> Sun, 08 November 2026 12:45 UTC

Received: from out-2z4y-a151.jellyfish.systems (out-2z4y-a151.jellyfish.systems [198.54.127.151]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id BD1DF47 for <oauth@ietf.org>; Sun, 08 Nov 2026 12:45:17 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=yuthent.com header.s=default header.b="0H/d71+H"; spf=pass (mx.ietf.org: domain of mohamad@yuthent.com designates 198.54.127.151 as permitted sender) smtp.mailfrom=mohamad@yuthent.com; dmarc=pass (policy=reject) header.from=yuthent.com
Received: from mail.privateemail.com (unknown [5.28.175.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 4jMt0n16Nhz2x98; Sun, 08 Nov 2026 12:44:56 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yuthent.com; s=default; t=1794141897; bh=5oXcQUG+ndCxx+1WkspDb9lvjSg1170XTaUmnew9qjc=; h=From:Subject:Date:Cc:To:From; b=0H/d71+HFs3iNzIVe8OBrZrmnYR39gCTVRaKeZAJoQjA136qOpoINhFSxWg/752JG CRB7ZBQ08d2b9bKO3Y4nnX7dlv+TjMHiWd+1Kp160MD1JFoCyGPMZLmDaij997BSoE Xl8Uav/uHfkVLFGKhHN6yCNeX733tDMpRPkXFYq0hID20BdZqOzLQ0Hyu8+zLc19hE SUQIBTYDdK5c0U/raFd/NRLTmu6e7+ycDTHi0zrJC1OMmG8lENkZb4DU4p9j3FXBqT obX210n2AAhq/d3D9Xz2YG3Hj+0+99r1Mu9r7MnsjEFaO9t+WL91UVNrAMJQ32ptI+ ddhznCnxZzCbQ==
From: Mohamad Khalil Yossif <mohamad@yuthent.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_509373AC-4342-4C77-889D-17953127C4B5"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3901.200.71.1.16\))
Message-Id: <9B1905C4-12BA-4F1C-BD0F-CEDD5975D9FE@yuthent.com>
Date: Sun, 08 Nov 2026 14:44:44 +0200
To: oauth@ietf.org
X-Mailer: Apple Mail (2.3901.200.71.1.16)
X-Envelope-From: mohamad@yuthent.com
X-Spamd-Bar: ----------------
Message-ID-Hash: LNHKQWYO44Q3OOSCOU7RVYCJ36WW5C6S
X-Message-ID-Hash: LNHKQWYO44Q3OOSCOU7RVYCJ36WW5C6S
X-MailFrom: mohamad@yuthent.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-oauth.ietf.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: paul@barefootcoders.com
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [OAUTH-WG] Re: New Draft: draft-williams-oauth-poi-core-00 (Proof-of-Intent Core)
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/JAOcNgwRIJuiIxUVCIy2iSJMQIg>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

> Paul,
> 
> The attestation in PoI Core is close to what draft-yossif-psea defines
> as a token. PSEA is an EAT profile, in RATS since February: the
> approver's enrolled authenticator signs, after user verification, over
> the SHA-256 of the RFC 8785 form of the exact action parameters. It
> has 31 public conformance cases and one independent verifier that
> reproduces them.
> 
> PSEA says nothing about how the resource server asks for the approval
> or how the client key is certified. PoI Core defines both. So the two
> look complementary rather than competing: the PoIE could carry a PSEA
> token as its attestation, instead of each defining its own.
> 
> Would you be open to checking whether that fits?
> 
> Mohamad

v2.46.0 | Report a Bug | By Email | System Status