IETF Logo Mail Archive

Re: [OAUTH-WG] why are we signing?

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 03 December 2009 22:21 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B79A28C1CC for <oauth@core3.amsl.com>; Thu, 3 Dec 2009 14:21:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.064
X-Spam-Level:
X-Spam-Status: No, score=-1.064 tagged_above=-999 required=5 tests=[AWL=-0.771, BAYES_00=-2.599, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HELO_MISMATCH_COM=0.553, RDNS_DYNAMIC=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASoaWHNqdj4y for <oauth@core3.amsl.com>; Thu, 3 Dec 2009 14:21:30 -0800 (PST)
Received: from mail.newbay.com (87-198-172-198.ptr.magnet.ie [87.198.172.198]) by core3.amsl.com (Postfix) with ESMTP id 3C65228C1BD for <oauth@ietf.org>; Thu, 3 Dec 2009 14:21:29 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mail.newbay.com (Postfix) with ESMTP id EEA523600BB; Thu, 3 Dec 2009 22:21:19 +0000 (GMT)
X-Virus-Scanned: amavisd-new at newbay.com
Received: from mail.newbay.com ([127.0.0.1]) by localhost (mail.newbay.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qyLt8sWkRq1d; Thu, 3 Dec 2009 22:21:15 +0000 (GMT)
Received: from mail01.newbay.com (mail01.newbay.com [192.168.12.25]) by mail.newbay.com (Postfix) with ESMTP id A810E3600BA; Thu, 3 Dec 2009 22:21:15 +0000 (GMT)
Received: from localhost (localhost.localdomain [127.0.0.1]) by mail01.newbay.com (Postfix) with ESMTP id 9AD137C326; Thu, 3 Dec 2009 22:21:15 +0000 (GMT)
X-Virus-Scanned: amavisd-new at newbay.com
Received: from mail01.newbay.com ([127.0.0.1]) by localhost (mail01.newbay.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MDlsHsU401D3; Thu, 3 Dec 2009 22:21:11 +0000 (GMT)
Received: from [10.87.48.3] (dsl-102-234.cust.imagine.ie [87.232.102.234]) by mail01.newbay.com (Postfix) with ESMTP id 402217C322; Thu, 3 Dec 2009 22:21:11 +0000 (GMT)
References: <daf5b9570911082102u215dcf22gf0aeb2f3578e5ea0@mail.gmail.com> <cb5f7a380911120745w2f576d1ej300723581e50f03f@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E72343785102E58@P3PW5EX1MB01.EX1.SECURESERVER.NET> <cb5f7a380911130837q40d07388y1ae9b472be0ae57a@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E72343785102F1F@P3PW5EX1MB01.EX1.SECURESERVER.NET> <A4E79C63-7B5C-4FBA-9DDA-5FEB35B9584D@microsoft.com> <3D3C75174CB95F42AD6BCC56E5555B4501F19743@FIESEXC015.nsn-intra.net> <90C41DD21FB7C64BB94121FBBC2E72343785209BBB@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4B15D7C2.2070901@stpeter.im> <90C41DD21FB7C64BB94121FBBC2E72343785209F78@P3PW5EX1MB01.EX1.SECURESERVER.NET> <daf5b9570912011946j600f8cbcl918af16fbbbc3206@mail.gmail.com> <EDFFBBF1-7FBB-4F4E-A0D8-B92C9036B33C@microsoft.com> <90C41DD21FB7C64BB94121FBBC2E72343785209F94@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4B1637EB.5080502@cs.tcd.ie> <4B183037.9050201@stpeter.im>
Message-Id: <828931C9-9038-4B97-AF79-7C5FA3E9CD17@cs.tcd.ie>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
To: Peter Saint-Andre <stpeter@stpeter.im>
In-Reply-To: <4B183037.9050201@stpeter.im>
Content-Type: text/plain; charset="us-ascii"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
X-Mailer: iPhone Mail (7D11)
Mime-Version: 1.0 (iPhone Mail 7D11)
Date: Thu, 03 Dec 2009 22:21:07 +0000
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] why are we signing?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Dec 2009 22:21:31 -0000

On 3 Dec 2009, at 21:40, Peter Saint-Andre <stpeter@stpeter.im> wrote:

> <hat type='chair'/>
>
> On 12/2/09 2:48 AM, Stephen Farrell wrote:
>> I think we'll need an analysis of where we end up wanting TLS
>> for the protocols we produce. I wouldn't expect any big
>> surprises, but right now I don't think we can be sure since
>> things seems to be in flux to some extent.
>>
>> Then, I'd be for saying that TLS MUST be used for those operations.
>> However, I can well believe that there may be some niches where
>> using TLS isn't easy, so I could live with something like: it MUST
>> be possible to use TLS, and that deployments SHOULD use it, with
>> guidance as to the type of scenario where we think TLS really
>> has to be turned on, and maybe text about why sometimes people
>> can't do that.
>>
>> So I don't think we can finish this discussion at this stage.
>
> I think we can:
>
> 1. Software MUST implement TLS
> 2. Services should deploy TLS

Tend to agree. What I meant we couldn't yet do was say for exactly  
which operations we think TLS should be turned on, and what it means  
to not use TLS in those cases,
S.

>
> Traditionally, RFCs enforce conformance requirements only on software
> implementations, not on service deployments. And here there seems to  
> be
> enough variation in deployment land that "should deploy" is as far  
> as we
> can go.
>
> Peter
>
> -- 
> Peter Saint-Andre
> https://stpeter.im/
>
>

v2.23.0 | Report a Bug | By Email