IETF Logo Mail Archive

Re: [OAUTH-WG] OAuth token entropy

Brian Campbell <bcampbell@pingidentity.com> Fri, 02 November 2012 18:19 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 572021F0C59 for <oauth@ietfa.amsl.com>; Fri, 2 Nov 2012 11:19:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.976
X-Spam-Level:
X-Spam-Status: No, score=-5.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YM4AM2wYaldU for <oauth@ietfa.amsl.com>; Fri, 2 Nov 2012 11:19:52 -0700 (PDT)
Received: from na3sys009aog130.obsmtp.com (na3sys009aog130.obsmtp.com [74.125.149.143]) by ietfa.amsl.com (Postfix) with ESMTP id 9CAEF1F0C60 for <oauth@ietf.org>; Fri, 2 Nov 2012 11:19:52 -0700 (PDT)
Received: from mail-vc0-f198.google.com ([209.85.220.198]) (using TLSv1) by na3sys009aob130.postini.com ([74.125.148.12]) with SMTP ID DSNKUJQOx5X9SUBDX6k7mgvtvSFfYKhCvdah@postini.com; Fri, 02 Nov 2012 11:19:52 PDT
Received: by mail-vc0-f198.google.com with SMTP id d16so6560930vcd.1 for <oauth@ietf.org>; Fri, 02 Nov 2012 11:19:50 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=r5JKq6EsBAxMzA1zJDxZrf9/RWcHQOvOWWq0zsZjUa8=; b=AlfqFm6NgAdmelHjDI0sd6qL8J046yr+27dSnFKUnH3h1/GRjx5gAN/I7fj41oDL03 yb27bEjcsskoW9OyiDgtxVuYDiWVzKWPbkv/HbjhWrQ1j0FxW0PNu/zgWHEaAs1EAbLX vIbD1z/Jzzxeh6JPraTr+KuUDxxoiIx1qUrseEmk3NAOvsTQyrz2M/3zHDYlNLjFg7Ri fp+LNbaNhIXsDvOmDfItneCwVoOiiYyKDVGZBx60MbpS8H/EwEAm0BOR9FIXrAQyfOLg KjC9sOEB++97fzA4nT95TA8MSSO3b3ZFnU987qXRkgLWXE3m4lC+mk4mCHgbn89AkESf zjPg==
Received: by 10.49.85.202 with SMTP id j10mr3922520qez.59.1351880390818; Fri, 02 Nov 2012 11:19:50 -0700 (PDT)
Received: by 10.49.85.202 with SMTP id j10mr3922485qez.59.1351880390468; Fri, 02 Nov 2012 11:19:50 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.49.6.3 with HTTP; Fri, 2 Nov 2012 11:19:20 -0700 (PDT)
In-Reply-To: <1351873006.52556.YahooMailClassic@web121003.mail.ne1.yahoo.com>
References: <1351873006.52556.YahooMailClassic@web121003.mail.ne1.yahoo.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 02 Nov 2012 12:19:20 -0600
Message-ID: <CA+k3eCSQk0aZN-bCRD=G+gQO6hkFNwBGRS62RBT7Vqf_v1wskQ@mail.gmail.com>
To: Oleg Gryb <oleg@gryb.info>
Content-Type: multipart/alternative; boundary="047d7bdc8d2073e2ba04cd872ef8"
X-Gm-Message-State: ALoCoQkG7FDoaHEpy+oCvunzc+n1QzJPl9AkwgguLNgXnelNM36zX49yp82wEIlPXNFsLmya002XtzCPJ/9w8oHGVQzOGI1ZcJo2e58wfOHb+/ZzqHc8Lcm+kM+q0p+3MC4somEvmRqk
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth token entropy
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Nov 2012 18:19:53 -0000

I believe the original text (which was borrowed from elsewhere) had a must
followed by a should rather than two shoulds like that. The text seems to
have drifted a bit in various places but the threat model text should
probably be aligned with what's in core OAuth at
http://tools.ietf.org/html/rfc6749#section-10.10


On Fri, Nov 2, 2012 at 10:16 AM, Oleg Gryb <oleg_gryb@yahoo.com> wrote:

> Can somebody please provide clarification for this:
>
>  <http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-05#section-5.1.4.2.2> <http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-05#section-5.1.4.2.2>http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-05#section-5.1.4.2.25.1.4.2.2 <http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-05#section-5.1.4.2.2>.  High entropy of secrets...
>    The probability of any two Authorization Code
>    values being identical should be less than or equal to 2^(-128) and
>    should be less than or equal to 2^(-160).
>
>
>
> Is there any reason why we have two inclusive conditions in this statement
> or is it a typo and you meant something else?
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>

v2.23.0 | Report a Bug | By Email