[OAUTH-WG] Recommended token format

[Christian Holm <[e-mail]>]

Hi

We are in the process of defining a REST interface for our application, and
are looking to use OAuth 2 as the authentication mechanism. I have read
through the latest specification, and it seems like a perfect fit for our
needs. Our main dilemma is with regard to the format of the access token. As
I understand there are basicly two options:

* Use the token as an "artifact", ie. just a randomly generated string which
is stored centrally. When accessing a resource with the token, the token is
verified by looking it up in the central repository and making sure the
requested resource can be accessed.
* Encrypt the authentication into the token. This way the resource server
can verify the access directly from the token without checking with the
central repository. This is particularly a good idea if the authentication
servers and resource servers are hosted in different data centers.

We would like to go with the second option, but since my cryptology
knowledge is less than could be wished, I have a had time deciding on the
format. I would assume we would have to put the user, the expiry time and
the scopes into the token (perhaps with some random letters in between) and
then encrypt that using f.ex. AES. Are there any recommendations on the
format and encryption method to use? I realize that publicly disclosing the
format could weaken it slightly, so the recommendations will have to be
fairly generic.

Thanks for the help and the excellent work on the OAuth 2.0.

Christian Holm