Re: [OAUTH-WG] Proposed changes to RFC 8705 (oauth-mtls)

Neil Madden <> Thu, 09 December 2021 13:52 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 863293A0CAC for <>; Thu, 9 Dec 2021 05:52:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Oars9nYd00E7 for <>; Thu, 9 Dec 2021 05:52:15 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::52f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 80DAC3A0CA0 for <>; Thu, 9 Dec 2021 05:52:15 -0800 (PST)
Received: by with SMTP id t5so19863606edd.0 for <>; Thu, 09 Dec 2021 05:52:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=xsFwgoWYJ9r3W+54fravaRUBict8fR5QunNDBudfgz8=; b=dQCsQ1BQ1zcTVTF+92WSuorNpHFy5IglWrw7jPlq8qcqb6mB5Qsvv327Wso6PU35Mp 1x5lk3HYFpschUIz2N9vY4FDlS89Zk6n/EI1rfdeOkwTHTNovZ7pLb69SPq97Bf4FSZg 8OhdJ1iqKGuNNJxATwhPXarzZiihNAY7LLtYE=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20210112; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=xsFwgoWYJ9r3W+54fravaRUBict8fR5QunNDBudfgz8=; b=a8vIe1sUx/V+Mq3PN/GZ1s7/Tcu8XHUu4sfSUxF9S4kRY2JxXMKk3MicrLDhNDY6iI HshHJziXQopy8ZA9bnFDGqBQQqLg2T0zHOqnJND6fvRxwJu1Yy9tgcQ2KGSO5wzjcxHy 6CFps76rJaRs3RgrtHrqnykT+DgsLfMY13T//0G/QPntfzHk3NlblYWr1COTBFYj1IHw dzRw5j8plqoHDkYRMKP8u48Tk2SmCxOxKINqwyzhIUPc1DCpUgmIVWsbTXsjkEm86W49 JzleazKDwUjPqK/VEvVDaTUTaB2zt/062mmuxTG0dFiK/dchaIG4Wc3yKphr2L42XoJY 5bzw==
X-Gm-Message-State: AOAM530tqxOUy8cXz4/txUeqTPZDM7mlCbZtKE3K4TH7Pz9xLUeEIz4Z jiPOfelXFfXP0z0KDN3leBGlQLTmgC5qvA==
X-Google-Smtp-Source: ABdhPJwsL+y0XhpjvvI22yiyYWtTYg6P9sjLKLuorOSDxMJqL5uFwWjMm/T1b68zbcg/0A7fx9kPjQ==
X-Received: by 2002:a17:907:7fa9:: with SMTP id qk41mr15455286ejc.422.1639057928296; Thu, 09 Dec 2021 05:52:08 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id hv17sm2968779ejc.71.2021. (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Dec 2021 05:52:08 -0800 (PST)
From: Neil Madden <>
Message-Id: <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_2ACEE23D-688C-4143-8C59-878BD7587842"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.\))
Date: Thu, 09 Dec 2021 13:52:06 +0000
In-Reply-To: <>
Cc: oauth <>
To: Dmitry Telegin <>
References: <>
X-Mailer: Apple Mail (2.3608.
Archived-At: <>
Subject: Re: [OAUTH-WG] Proposed changes to RFC 8705 (oauth-mtls)
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 09 Dec 2021 13:52:21 -0000

I don’t mind about a new error code, although I think it’s of limited value - error codes (rather than descriptive error *messages*) imply that the client may be able to dynamically react to the situation and so something different. But TLS client certs are usually configured statically, so it seems highly unlikely that the client could satisfy this requirement on its own. (Especially without all the other hints that would be missing from the TLS layer, like trusted CAs, supported signature algorithms, etc).

I am against changing the token type/scheme from Bearer to MTLS.  Mostly because of backwards compatibility issues - we already have customers that have deployed mTLS widely, but also because of conceptual issues I have generally with distinct token_type/schemes:

1. Whether an access token is mTLS-bound or a pure bearer token is a property of what the RS enforces, not intrinsic to the token. As far as I am aware, there is no spec anywhere that says what an RS should do if it doesn’t understand a particular confirmation method associated with an access token. So you can easily at present have a situation where an AT is valid at multiple RSes, some of which understand mTLS-binding and some of which do not. Indeed, this is very likely (and desirable) when you are in the process of rolling out stronger security mechanisms on an RS-by-RS basis. (And what if you later decide to move from mTLS to DPoP?) IMO requiring that ATs always have one and only one associated PoP mechanism is a recipe for ossification.

2. IMO the “token_type” and Authorization scheme should be primarily about how the AT itself is conveyed to the RS, not about how any associated proof is. Although “Bearer” is not the most appropriate name, I would rather we stuck to that one scheme for conveying ATs regardless of whether they are pure bearer tokens, bound tokens, or whatever. To me, the important part of “Bearer” is that it tells the RS that it can send this token directly to an introspection endpoint (or examine it locally) without first performing some additional processing on it.

3. I am generally in favour of allowing ATs to have 0, 1, 2 or any number of confirmation methods associated with them. If we want to make it easier for a client to figure out which ones an RS supports, I’d rather see this as an enhancement to the Bearer WWW-Authentication challenge - e.g. WWW-Authenticate: Bearer … supported_cnf_methods=mtls,dpop

Anyway, can of worms well and truly opened…

— Neil

> On 9 Dec 2021, at 13:23, Dmitry Telegin <> wrote:
> There following changes to RFC 8705 have been proposed:
> - introduce a new error code (e.g. "invalid_mtls_certificate") to be used when the certificate is required by the AS/RS, but the underlying stack has been misconfigured and the client didn't send one;
> - for bound token use, change Authorization scheme from Bearer to MTLS;
> - for token response returning a bound token, change token_type from Bearer to MTLS
> See discussion: <>
> Accepting the changes would imply a new RFC and the obsolescence of the current one. Two questions so far:
> - what's the group's general stance on this, would that be a welcome change?
> - if so, could we also hear from the implementors if there any other issues / suggested changes.
> Dmitry
> Backbase / Keycloak
> _______________________________________________
> OAuth mailing list