[OAUTH-WG] why are we signing?

[Brian Eaton <[e-mail]>]

Hey folks -

What are the use cases for cryptography in OAuth?  Why are we signing
requests?  And how much of each request do we need to sign in order to
be useful?

As I see it, we have roughly the following menu of choices:

1) No signatures.
    Just use bearer tokens.  Use transport layer encryption to keep
those bearer tokens from leaking.

2) Signed tokens.
    We could just sign a timestamp, rather than entire messages.

3) Partially signed messages.
    We could sign just the request URL, or the request URL plus some parameters.

4) Fully signed messages.
     Sign as much of the HTTP request as possible, down to the bits of
the HTTP entity body.

My guess is we need at least two out of those four choices (one with
bearer tokens, a la OAuth 1.0 plaintext) and another with
cryptography.  But I'm not sure whether we need to sign entire
messages, or if we can get away with something simpler and still have
reasonable security.

Cheers,
Brian